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HS Good morning, Mr. Krebs. My name is J =—|'m senior 


investigative counsel for the select committee investigating the January 6th attack on the 
Capitol. 
With me here -- I'll let counsel that are here introduce themselves. 


HES Good morning, Mr. Krebs. |'m[.—s'm the chief 


investigative counsel to the select committee. 

EE, «Good morning. |'m MM 'm senior 
investigative counsel on the committee. 

HE And | noticed that at least one of our members, Ms. Lofgren, is on 
the Webex. | will attempt during the course of the day to keep my eye on that and 
advise you and recognize the members as they come. Not necessarily as they drop off, 
because they may be coming and going and that might be a challenge for me, but I'll do 
my best to make sure that you're clear as to who's here from the select committee. 

If | could ask, Jim, could you introduce yourself for the record? 

Mr. Walden. Yes. Jim Walden. I'm Chris' counsel. 

=| And John? 

Mr. Luce. John Luce with the Department of Homeland Security. 

a And, John, do we have some of your colleagues on the Webex as 
well? 

Mr. Walden. Wedo. Jackson Eaton and Victoria Rappaport | see are on 
Webex. 

Bs So, Mr. Krebs, this is -- it's not a deposition, you're not under oath, 
but everything that we say during this interview is being taken down by the reporter to 


your right, and there will be a verbatim transcript created after the interview is 
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completed. 

You'll -- we'llsend a copy to Mr. Walden. He'll have a chance to go over it with 
you and make sure that it's accurate. Just wanted you to be aware of that. 

Mr. Krebs. Got it. 

_———— | Because we're creating a verbatim transcript, it's important that a 
couple of ground -- we follow a few ground rules. One is that we not talk over one 
another. 

Mr. Krebs. Uh-huh. 

Gs One is that we have audible responses, not uh-huhs or shakes of the 
head, and just try and do our best to make sure that the reporter can hear us clearly and 
create an accurate record of our interview. 

Mr. Krebs. Understood. 

i ——— 23 Okay. You are not -- as | said, you're not going to be placed under 
oath today or you're not under oath today, but this is a Federal proceeding, and you're 
required to tell the truth in a Federal proceeding. And if you were to make a knowingly 
and willfully false statement, you could subject yourself to criminal punishment under 
Section 10001 of Title 18. Are you aware of that? 

Mr. Krebs. | am now, yes. 

Bs And that is an admonition we give to all witnesses, not to you 
specifically because of any expectation that you'll be anything other than truthful. 

Mr. Krebs. Understood. 

BS WVe're going to - if you need a break at any time to talk to 
Mr. Walden or otherwise, just let me know. _ If a question that | ask is not clear and 
you're not sure exactly what I'm asking, please stop me, ask me to reframe it, rephrase it, 


and I'lldo that. Sound good? 
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Mr. Krebs. Yes. 

a Okay. I'm going to be taking the lead with the questioning, but over 
the course of the interview, others may jump in with their --] or i may jump in 
with questions, and the members may have questions as well. 

And from time to time -- and | note that Mr. Raskin has now joined us. _ | see 
Ms. Lofgren -- oh, she's still on as well. The list is longer. | have to figure out how to 
make sure we stay so that we can see the entire list of participants. 

Ns The new ones pop up on the top, so we'll be okay. 

MSs So Mr. Raskin is here. Ms. Lofgrenis here. They may have 
questions, and other members that join may have questions from time to time. And I'll 
pause during the course of the questioning to give them an opportunity to raise any 
questions that they have. 

Any questions for me before we start? 

Mr. Krebs. | don't have any at this moment. 

—w John, do you have something you want to put on the record before 
we start? 

Mr. Luce. Yes, just one brief statement. Thank you. 

The Department has made available to the committee, consistent with requests 
from the chairman, information and records that the Department would not publicly 
release. This includes information and records covered under the Privacy Act, 
personnel, and other personal privacy information, for official use only, intelligence and 
law enforcement-sensitive records, and raw intelligence information. 

While the Department has made this information and records available to the 
committee, the Department asserts that such information and records provided to the 


committee and any discussion of such information or records during the course of the 
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transcribed interview is not intended for public disclosure. 

DHS is not waiving any protections, and for the purposes of administrative 
efficiency and to promote constructive dialogue during the transcribed interview, is 
making this assertion at the outset of the interview, to preserve all assertions and 
protection from public release or disclosure over information or records used or 
discussed during the interview. 

The transcript and any attachments are protected from further dissemination to 
the same extent as the documents and information they are based on. Please consult 
with the Department prior to any public release or disclosure. 


Thank you. 


PF Thank you. 
(eo ——— 7 HMMM sorry, one thing before you start. There's afnumber 


ending[il Can you identify yourself? 

Mr. Krebs. This is Elizabeth O'Connor. I'ma colleague of John's at the 
Department. 

BE Thank you, Elizabeth. 
EXAMINATION 
oY 

Q Mr. Krebs, can we start with just a brief -- some brief background questions. 
Can you describe your educational background? 

A | went to the University of Virginia, graduated in '99, environmental sciences, 
bachelor of arts. Moved up to D.C., went to George Mason Law School, now the 
Antonin Scalia Law School, evening programs for 4 years, finished up there in 2007. 
Passed the bar here in Virginia that summer, sworn in and an associate member of the 


Virginia Bar. 
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Q  Andcan you describe briefly your professional experience before joining the 
Department of Homeland Security in 2017? 

A So prior -- well, during law school, | was a contractor to the Department of 
Homeland Security and the predecessor to CISA, the National Protection Programs 
Directorate, | think, or it was PREP at the time, up until 2007. 2007, then | switched over 
to Schedule C political appointment within the National Protection Programs Directorate 
Office of Infrastructure Protection. | was senior adviser to Bob Stephan, the Assistant 
Secretary for Infrastructure Protection. That ran until January of 2009, witha 
switchover from the Bush to the Obama administrations. 

At that point, | followed Bob, and we set up a consulting firm at Dutko Worldwide. 
It was Dutko Global Risk Management. Did that for a couple years, and then went to 
another company called Obsidian Analysis and was there. It was a consultancy risk 
management company with both private and public sector contracts. 

Left there in 2014, went to Microsoft, where | was a cybersecurity policy expert, 
and stayed in that role until 2017, where | joined the Trump administration as senior 
counselor to John Kelly, the first Secretary of Homeland Security in the Trump 
administration. And | stayed in that role till approximately August of 2017, where | went 
down as the -- where | was appointed by the President as the Assistant Secretary for 
Infrastructure Protection. But given that role and the succession order of NPPD, | was 
then a Senior Official Performing the Duties of the Under Secretary of the National 
Protection Programs Directorate at the Department of Homeland Security. Also -- 

Q_I'msorry. Did you say that was a Presidential appointment? 

A Yes, that was a PA. 

Q Appointed by President Trump? 


A Yes, that's correct. Yes. 
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Q___ Sorry to interrupt. 

A It was -- within NPPD at the time, there was a PAS, and so the Under 
Secretary was a Senate-confirmed PAS. The Assistant Secretary was a PA, so 
Presidentially appointed with a commission and all that. And the other Assistant 
Secretary for Cybersecurity and Communications, who's Jeanette Manfra at the time. 
That was simply a Schedule C._ That has since changed due to the Cybersecurity and 
Infrastructure Security Agency Authorization Act. 

So that was 2017. | was then nominated in February of 2018 to be the Under 
Secretary of NPPD. | was confirmed June 23rd, | believe, of 2018, as the Under 
Secretary. That job then changed November 16th of 2018, when President Trump 
signed the CISA Act into -- into law. And then 2 years and 1 day later, November 17th, 
7:05 p.m., fired by a tweet. 

Q_ Thank you for that concise and thorough recitation of your background. 
It's very helpful. 

When did you start -- | take it that your work at NPPD included things other than 
election security. 

A That is correct. In fact, when | came in to the Department in 2017, | was 
really, | don't think, fully appreciative of the amount of work on the election security side 
that | would be doing. | was thinking more broadly just general cybersecurity, whether 
it's Federal cybersecurity work, critical infrastructure. 

But the mission of NPPD is broader than purely cybersecurity. It's actually risk 
management for critical infrastructure in general. So that includes physical security, 
cybersecurity, and emergency communications. 

And the threat model that we contend with or they contend with at CISA is all 


hazards. So it's technology risk, it's man-made risk, and it's natural disasters. In fact, in 
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2017, as the acting -- or the SOPDUS, the Senior Official Performing the Duties of the 
Under Secretary, the majority of my fall from 2000 -- I'm sorry, from August through, 
frankly, December, was spent with hurricane response. And so that was Harvey, Irma, 
and Maria. And -- 

Q_ Those were colleagues of yours? I'mkidding. I'm kidding. 

A Hurricanes Harvey, Irma, and Maria, and spent a fair amount of time. | 
think | actually went to Puerto Rico three or fourtimes. In fact, | was on the ground in 
Puerto Rico the Monday after landfall, where the majority of the power was still out 
across the island and which continued for some time, and then also led a congressional 
delegation down. And, in fact, on that congressional delegation was the now Vice 
President. 

So it was at that point at the kind of conclusion of hurricane season where | hada 
chance to reassess where we were as a component, as an agency. And at the time, 
there had been a number of election security-related activities. 

In fact, September 21st, | believe it was, 2017, is when | think the -- I'm trying to 
get the right adjectives here. It's when the Department sent out a series of notifications 
to State officials about what was then known as the 21 States which were targeted by the 
Russians in the 2016 election. 

And so through the course of the remainder of 2017 and then into 2018, January 
or so, February really is when | think we really ramped up our election security work with 
a dedicated task force, dedicated ISAC. Working with a multi-State ISAC in upstate New 
York, we hosted a top secret classified briefing with election officials. It was actually the 
same day the Department of Justice indicted a series of Russian actors for -- well, it was 
indicted or sanctions. Anyway, it was literally, we were sitting outside the intelligence 


community campus about to go into a meeting when the Attorney General and the FBI 
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Director made the announcement. So that was February of 2018. 

Q__ Sois it correct to say that prior to late 2017, election security hadn't been a 
professional focus of yours, or am | overstating that? 

A | think that's accurate. | think in my time at Microsoft, | was tangentially 
associated with some election security work, because a lot of the activity that was -- some 
of -- rather, some of the activity associated with the 2016 election interference, targeting 
the DNC and other things, Microsoft saw some of that through their own visibility and 
telemetry and research. 

So -- but it is, | think, accurate to say that it was not a professional focus. 

Q And NPPD was not -- that was an area -- that was not an area of focus for 
you at NPPD prior to late 2017? 

A It was -- it was as -- it was an area of focus for NPPD. There in 2016, | 
believe -- this was, of course, before my time there. But in 2016, the summer of 2016, | 
think that's when the prior administration and the leadership under Jeh Johnson and 
Suzanne Spaulding and others, you know, under -- you know, came to appreciate what 
was happening. And they started to try to figure out how to work with State and local 
officials, and then we kind of picked up that mantle. But, again, it was not a -- of the 
broad set of issues | had to consider coming into that role in August of 2017, it was -- it 
was one of many, but it did become a significant focus. 

Q_ And starting from the time that you mentioned in late 2017 into early 2018, 
from that time forward to the time you left the Agency, would you say it was your 
primary focus? 

A It became the primary focus over time, particularly as we got closer to 2020. 
In the -- in late January-early February of 2019, after the 35-day government shutdown, | 


issued a set of Agency priorities. And there were five of them: Federal networks, 
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election security, physical security, control sys -- yeah, control system security and supply 
chain security. Those were the five areas of focus, and election security was at 
the -- typically, | would mention that second to emphasize the importance of the issue. 

Q_ Andis it possible for you to estimate in that sort of -- after the government 
shutdown, after you had sort of listed those priorities till the time you left CISA, roughly 
how many employees within CISA were focused on election security as a primary 
responsibility? 

A So there was the 2018, the midterm election, where we had an election 
initiative. We had a task force that was focused on those issues. So it was -- it wasn't 
just 2019 where all of a sudden it became a priority. It was, in fact -- it was in 2018 
going forward to the election. And, in fact, Kirstjen Nielsen was a big part of helping 
build that focus up within the Agency. 

I'd say at the time the number of people -- so 2018, we actually ran some numbers 
around this. | don't have the -- | don't recall the specifics, but it was somewhere on the 
order of October 2018 in the run-up to the election, over the course of that month 
anywhere, you know, around about 700 employees within CISA had done some sort of 
election security work. And that includes field personnel, so the Protective Security 
Advisors that are distributed across the country, the cybersecurity advisers, the other 
staff that are out there. 

We had elect -- we had exercise personnel that were running a series of tabletop 
exercises. We had folks in the threat hunting team. So there was a significant amount 
of people. Andso 700 actually probably is about athird. I'd have to go back and 
double-check those numbers. It was in the multiple hundreds. It was anywhere from 
400 to 700, somewhere in that range. 


Q And those, you're not counting State and local election officials? 


24 


25 


13 


A No, no, no. That's CISA Federal employees. 

Q Okay. And did that number -- and, again, I'm not holding you to an exact 
number, but did that sort of order of magnitude number persist through the 2020 
election? 

A Well, we did after 2018. So at the tail end of 2018 election, the midterms, 
there was an Executive Order 13848 signed in by the President that directed the Director 
of National Intelligence -- and this is important for two reasons. 

The President directed the DNI to conduct a threat assessment of foreign 
interference, and then the second piece of that is the 2A and 2B report. So that 
executive order directed the Attorney General and the Secretary of Homeland Security to 
conduct a materiality assessment, based on that threat assessment and the activities, 
what was the material impact upon the election. 

So we issued that report in December and January of 2018, in the midst of the 
shutdown. Actually, | had to bring people in off furlough or whatever we were calling it 
to conduct that. Geoff Hale and -- I'm sorry. |'m thinking back to the letter. 

Q_ That's okay. 

Mr. Luce. That's okay. 

Mr. Krebs. So it's just 14, don't -- 

Mr. Luce. Oh, yeah. 

Mr. Krebs. Names. 

Mr. Luce. Oh, yeah. For names, yes. 

Mr. Krebs. Okay. Ithink he'sa-- okay. So there were personnel. Matt 
Masterson who was an SES, he actually led that, led that work. 

So we issued that assessment. And then at that time, because of the -- because 


of the government shutdown, it was a natural kind of break point to reassess where we 
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were. Anda lot of those detail -- a lot of the people that were doing the election work 
in 2018 were detailees from other parts of, whether the Agency or NPPD at the time or 
the Department, including the Intelligence and Analysis. 

And so as we got through '18 and we did our own kind of internal hotwash and 
after action review, and we restructured from the Elections Task Force to the Election 
Security Initiative. And that launched in '19, much more focused. It resided within the 
National Risk Management Center. 

And some of the -- some of the people were the same, but then we swapped in 
new -- new personnel, and we had -- again, you know, there were still some I&A folks 
there as well. 

BY 

Q But the several hundred -- you estimated 700, but multiple hundreds of folks 
continued to do election security work through '19, 2019 and 2020? 

A So the key here is that, through the course of a workweek, a Protective 
Security Advisor or a cybersecurity adviser could go do a physical assessment of a dam 
and the then the next day could go meet with an election official to talk about -- 

Q Sure. 

A So | wouldn't say that 100 percent FTE on those issues. Now, | think it's 
also -- you know, as 2019 ramped up, we were also on the heels of new secretaries of 
state, new governors coming in, because of their own elections. And so it would have 
been kind of a sine wave of activity. 

But was it at the same pace of 2018? No. It was -- it -- you know, in '19 we kind 
of, again, reassessed what -- because we had scarce resources, so we had to kind of figure 
out, all right, what do we need to refocus on? Election security remains a priority. We 


got additional funding in. We were able to stand up a variety of -- go ahead, sorry. 
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Q Sol just want to get a sense of whether, in terms of personnel -- and | don't 
mean down to the FTE sort of numbers, but whether the scope of the effort 
maintained -- you said the pace slowed down a little bit, but are we dropping down to 50 
people or 100 people, or are we still in the several hundred people who are focusing their 
work on election security, whether as an FTE or not? 

A So let's back off the focusing the work, right? 

Q Okay. 

A Was it a part of a job description among other duties for several hundred? 
Yes. You know, was it a full-time job? | would say -- again, I'd have to go back and 
check some of those numbers, but it could be anywhere from, you know, full time, 
30-plus people. So it was a step back, reassess where we are, refocus our efforts and 
restructure our efforts, and then get ready for the push into 2020. 

Q Okay. And did things ramp up towards 2020 or -- 

A Absolutely, yes. 

Q__Interms of personnel? 

A Yes. Yep. So we would -- so the way it worked is -- and it's not in the 
materials, but | have acopy of it. | was just flipping through some stuff the other day. 
We released a strategic plan for Protect2020 in | think it was January 2020. 

The way it worked is we actually had an escalation ladder as we got closer to the 
election. So there was the core team. They would be doing the content development, 
the regular engagement with NASED, which is National Association of Secretaries of -- or 
State Election Directors, and the National Association of Secretaries of State. We would 
have exercise people. 

As we got closer to 2020, we started ramping up. So this team would come in 


and help support a specific effort. But as we got into, for instance, the primaries, we 
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went to a different posture where there were personnel in the -- what's now the CISA 
Central and the Integrated Operations Division that were focusing more frequently on 
election activity. As we backed off of primary season, then they would kind of return to 
their regular duties. And so it's similar to kind of a military construct where as activities 
ramp up, we bring more people in. As they ramp back down, we deescalate and they 
return. 

And over the course of the summer, | think we -- again, I'd have to go back and 
look at the ops plan, but | believe we started going to that more active posture in 
September of 2020, where we had significant additional support, from a monitoring 
perspective and a coordination perspective. 

Q  Gotit. Okay. Let me back up a little bit in terms of the -- you talked a 
little bit about the predecessor agency and then the creation of CISA. Can you just talk a 
little bit about your understanding of the impetus for creating CISA as a freestanding 
agency -- not freestanding, but creating CISA? 

A Operational agency within DHS. 

Q Yes. 

A So it had been, as | understand it, at least an effort that had been underway 
since probably 2010. Rand Beers, who was the Under Secretary then, you know, that 
was one of his key recommendations. So they pushed for it. 

Suzanne Spalding, my immediate predecessor, came in and she made a big push 
for it in the 2015 --'14,'15,'16 time. Couldn't get across the finish line. 

For me, it was my top priority coming into the administration, at least into DHS. 
Worked with the leadership, whether it was Secretary Kelly or then-Secretary Nielsen 
afterwards, had full support from the administration. 


My -- you know, | thought it was critically important for a couple different reasons. 
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It was recruiting. It was actual public engagement. Showing up and saying, hey, we're 
with DHS, doesn't always work. When you go to some organizations, like schools and 
colleges, they don't necessarily like DHS showing up. That's my opinion, by the way. 

Others is when you try to work with a private sector partner and you say, hey, I'm 
with the National Protection and Programs Directorate, they don't know what the hell 
that means. And so what we really wanted was an organization that clearly and 
concisely communicated what the mission of the Agency was, and cybersecurity right off 
the bat. 

So | came in -- 

Q How would you articulate the mission of the Agency when it was formed? 

A In 2018 or -- 

Q Yes. 

A _ The mission of the Agency -- 

Q  OfCISA. 

A Yeah. The mission statement, off the top of my head, | don't recall, but it's 
effectively to help -- help critical infrastructure manage risk. 

Q Okay. 

A From all comers, foreign, domestic, all hazards. 

Q Okay. And what did you understand the role of CISA to be with respect to 
election security? 

A So when you -- when you look at the intelligence community assessment of 
2017, it breaks down the Russian activity in 2016 into three buckets. First is targeting of 
election equipment; the second is targeting campaigns; and the third is just a broader 
disinformation, you know, disinformation efforts that the Russians have been doing for a 


century or more. 
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In terms of the bidding internal to the U.S. Government on who had lead in those 
three areas, it was clear, you know, once Jeh Johnson, the prior Secretary in 2017, 
January of 2017, designated election infrastructure critical infrastructure, it was, you 
know, CISA had the lead for working with State and local election officials on protecting 
critical infrastructure -- or election infrastructure. That'sthe systems. That's the 
hardware. That's the equipment and the processes associated with conducting an 
election. 

Q_ Andsocan| stop you there for a second? 

Yes. 

Q Is that primarily protecting against what we would think of as hacking? 

A No, not necessarily. It's, again, critical infrastructure, we had an all-hazards 
approach. So we worked with election officials to conduct active shooter drills and 
assessments. We would go look at election warehouses where equipment is stored in 
the off season, do physical risk assessments. 

In the wake of hurricanes, we would work with election officials. In fact, Kyle 
Ardoin, who's the Secretary of State in Louisiana, in 2000 -- the summer of 2020, | guess, 
where they got hit pretty hard by an election, we helped him work with FEMA and some 
of the response efforts there to get resources he needed to be able to conduct the 
election in 2020. 

So it was not just cyber. That tended to be the public -- at least what the public 
cared about or the media cared about, just because it's 2016, but it was -- again, it was an 
allhazards. And we did -- | don't want to put numbers on it, because | don't recall, 
again, off the top of my head, but a significant number of physical assessments of election 
facilities. 


Q  Gotit. Gotit. And would that include things like -- and | don't know if this 
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is an EAC issue, but I've heard or read about the ballot paper and sort of the security 
issues with respect to the type of paper that's used for ballots and things like that. 
Would you put that in the infrastructure context or only physical machines you're talking 
about? 

A From the perspective of, you know, selecting paper, no, that's not a process 
that we were involved with. _ If it was a -- you know, if an agency asked for advice on 
how would we protect a logistics supply chain for paper, then we could give them some 
advice -- 

Q Gotit. 

A -- on how to do that and how to secure the facilities, for instance, that hold 
the ballots. But from picking paper or designing paper, things like that, that was not. 
That was more of an administration, election administration requirement. 

Q_ And picking or designing machines, any role that CISA played? 

A So we certainly had risk management opinions about -- or perspectives, 
rather, about the types of machines that were in use. And froma risk management and 
resilience perspective, we strongly encouraged and, you know, even advocated to the 
Congress on behalf of States for machines that had paper trails, so voter verifiable paper 
audit trails. 

If you recall, in about 2016, there was probably about little under 80 percent, 
according to the Center for Election Innovation. The -- | think it was about just under 80 
percent of votes cast had a paper record associated with it. There were five States at 
the time -- Louisiana, Georgia, South Carolina, Delaware and New Jersey -- that had the 
DREs, the direct recording equipment. So you touch the screens, it's tracked on 
removable media. 


Over the course of the 4 years between '16 and '20, that number -- | think the 
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number for 2020, it was around 95 percent of votes cast had a paper trail associated with 
it. And, you know, our encouragement there was because of the auditability. And 
auditability is resilience. And so if, you know, Georgia or something got popped, then 
it'd be harder to -- or there were claims or actual technical interference with the DREs, it 
would be harder to track. 

And | think we were hugely successful in at least helping push that initiative and 
that transformation across elections from '16 to'20. There was -- in The Washington 
Post Cybersecurity 202 this morning, in fact, there's a -- the front matter of that piece is 
about how Louisiana is the only State left that's statewide DREs. 

Q_ That was going to be my question. Do you know in November 2020 
which -- there may be small counties here or there, but do you know generally which 
States had not made the transition to paper ballots? 

A Statewide, the -- 

Q Or, no, just had jurisdictions within the State that were not -- did not have 
paper ballots. 

A So Georgia, South Carolina, and Delaware both made the switch over to, in 
some cases, ballot marking devices. | know both Georgia and Pennsylvania had those. 
So New Jersey was a State that had DREs, but due to the pandemic, they switched over to 
absentee or mail-in balloting. 

Louisiana -- so what remained as | understood -- understand it, rather, it was 
Louisiana statewide, Tennessee, Indiana, Texas, and a handful of others. Now, you may 
find DREs in a small -- in use in small amounts across the country for accessibility 
purposes, for people that just can't use paper. But at a larger scale, it's Tennessee, 
Indiana, Texas, and Louisiana. 


Mr. Walden. I'msorry. He asked youa question. | just want to make sure 
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your answer is clear. | won't do this very often, but | just want to keep track. 

So the ones -- the only ones statewide that didn't have it was Louisiana, 
Tennessee, Indiana, and Texas. Some locations didn't have it? 

Mr. Krebs. Right. 

Mr. Walden. But New Jersey, Georgia, South Carolina, and Delaware did? 

Mr. Krebs. So in 2020, South Carolina had -- by 2020, South Carolina had 
switched to a paper trail. Georgia had switched to a paper trail. Pennsylvania had 
switched to a paper trail. New Jersey just chopped over to absentee. And Delaware 
had switched as well. 

BY 

Q Now, but -- and | understood those were switch-overs for 2020, but it's not 
to suggest that other States throughout the country that you're not listing, those also 
were paper. So California, Pennsylvania, Michigan -- 

A __ Right. 

Q_ --those were all -- those were paper as well? 

A Yes. So, again, just to restate, for 2020, the States that had a significant or 
substantial number of DREs, so, again, Louisiana was statewide, and then there were 
counties or jurisdictions within Tennessee, Indiana, and Texas. Those are the ones that 
are immediately coming to mind. And there are a handful of others, but those are 
the -- those are the bigger vats. 

Q  Gotit. Sol interrupted your answer earlier to get onto the infrastructure 
protection. You talked about sort of other -- you talked about a three-pronged -- 

A Yep. 

Q_ -- concern with respect to what the Russians had done in 2016. Does that 


sort of track to sort of the three prongs of what CISA was focused on? 
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A So on the election infrastructure, CISA had lead across the Federal 
Government. So we would lead the engagement with State and local election officials 
to conduct risk assessments, improve the security of their -- their systems, to conduct 
training, coordinate, share intelligence and information. And then FBI supported us. 
The intelligence community supported us. 

On the second piece with campaigns, FBI generally had the lead where we would 
support. We would provide any sort of assistance, but there was not a whole lot of 
support requested from any of the Presidential or other Federal campaigns. They 
were going to do their own thing and -- 

Q And when you say campaigns, what are you referring to there? | mean, 


what's the threat or what's the issue? Infrastructure | think you've explained well, sort 


of the risks -- 
A __ Right. 
Q  --andthethreats. When you say campaigns, what are you referring to? 
So the DNC, the RNC, the actual -- you know, the Biden campaign, the Trump 
campaign. 


Q But efforts by some mal actor to steal material? 

A Correct. Soin 2016, the Russians hacked into the DNC and exfiltrated email 
and released those emails through various means. And so our -- you know, the concept 
there was, okay, it happened before. This is part of the playbook, so we should offer to 
those campaigns support if they need it. 

So what we would generally do in a one-for-one bipartisan manner -- so if we 
briefed the RNC, we briefed the DNC. If we briefed the Trump campaign, we briefed the 
Biden campaign, or we'd at least offer it, and offer them an assessment of what we saw 


was happening in the world. 
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Some of those briefings were classified. | never participated in any of the 
briefings to -- so I'll say that, as far as | can remember, | think | was in one meeting at the 
RNC with Ronna McDaniel, where we kind of just talked about elections. But, generally, 
in -- that was the 2018 timeframe. 

For 2020, as we ran up, it was typically -- those briefings were typically led by a 
career official, for purposes of remaining nonpolitical. 

Q With the goal being how to help the campaigns or the party committees 


protect their information from -- 


A Yes. 
Q -- intrusion? 
A Yes. 


Q  Foreignor domestic? Did you have a -- was there -- 

A | mean, we would generally brief them because of the intelligence 
community's, you know, purview, on foreign threats. So if we saw something coming 
from Russia, Iran, you know, China, whatever, it would be -- you know, we would be able 
to provide that to them to help them understand the risk landscape. But, again, that's 
because of the information we had available. | don't think there was any domestic 
technical information that would have -- would have come up. 

Q But did you feel that there was some lane of authority there that you had to 
observe in terms of where that -- the threat of intrusion might come from? So, in other 
words, if it was a -- if it was a hacker in his parents’ basement in New Jersey, is that a 
threat that you considered part of your mandate to address and brief the campaigns on? 

A So break things apart here. So froma threat modeling perspective, you 
know, based on the available intelligence, those concepts would be primarily driven by 


foreign actors. It would be, hey, here's what the Russians are doing. And a lot of that 
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was informed by things that Cyber Command was doing. 

So Cyber Command was doing some foreign operations -- this is 
unclassified -- foreign operations in Ukraine and other Eastern European countries where 
they could actually observe in those networks. They'd partner with their own country. 
They'd partner with those countries, and they'd be able to see Russian GRU activity. 

And what we'd be able to do is we'd be able to take the techniques that they were 
using. We'd be able to take the malware that we found or that the -- and then as well as 
the targeting sets. And whether it was election night reporting or voter registration, 
package that up and then turn around and share that with -- with our State 
election -- State and local election officials. 

We also partnered with FireEye and other cyber threat intelligence companies to 
do the same thing. It was like, hey, this is the activity we're seeing. And because 
they're a private sector organization, there is no domestic Fourth Amendment issues. 
And so they were able to pull together any sort of information they saw from threat 
actors, but they don't get too deep into the attribution game. And we'd share that. 

So that's from a threat modeling perspective. But froma defensive posture 
perspective -- 

Q Yes. 

A -- jt doesn't matter. Because, frankly, when you see the activity, you don't 
know. It takes quite some time to figure out who the bad guy is most of the time. And 
so it wouldn't have mattered for us if it was a domestic or a foreign actor. We provided 
security advice from all comers to help them defend from any bad actor. 

Q__ So, from your perspective, there was no bright line that you needed to 
observe, in terms of advising the stakeholders, whether it's local -- State and local 


officials, campaigns is what we're talking about now, you didn't feel that you needed to 
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back off if the perceived threat included domestic actors? 

A From a cyber perspective, absolutely not. | mean, look, there are criminals 
here domestically that would try to hackin. | mean, there were some investigations 
that, | understand it, after the 2016 election related to domestic cybercriminals that were 
trying to hack into databases and things like that. 

So for us it was -- because the techniques aren't going to change all that much. 
They use the same tools. And that's -- so it doesn't matter, right? 

Q- Okay. Let's -- sorry. 

A Sorry. And there's a second piece here is that some of the techniques that 
were used in 2016 by the Russians, it continues to today for both Russia and China. But 
what they do, it's not like they try to come at you from a Russian IP address. 

So you can't just say, oh, block all Russian IP space from connecting to your 
network, because what they're doing is they're jumping around the global internet, and 
they will pop up in domestic hosting providers. And so they'll use virtual private servers 
that are domestic based. 

Microsoft just did a blog on this, or FireEye -- or Mandiant and Microsoft, where 
they would come into an area -- so let's just use -- I'll just randomly pick, say, Georgia, 
because that's where I'm from. _ If they were trying -- if a bad guy is trying to go after a 
target, so if a Russian is trying to go after a target in Georgia, what they will do is they'll 
come in and they'll compromise hosting infrastructure in Georgia. So when you see the 
traffic, it would look like someone that's a customer in the same city or the same town or 
whatever. So that's just one of the techniques. 

So you can't tell that it's Russia coming in. So, again, our advice was almost 
agnostic to the specific actor and, instead, a defend against all threats. 


Q Okay. But not just -- and | think I'm just restating what you said earlier. 
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But you were agnostic not just because the Russians might be posing as a Georgian in the 
State of Georgia, but because there might be someone who actually is an American 
citizen within the State of Georgia could be doing the same sorts of things that you're 
worried about? 

A Soyes. And this is not specific to election infrastructure. This is all critical 
infrastructure, right? So when we work with chemical facilities -- and there's a 
significant chemical security effort at CISA -- we would not just be worried about al-Qaida; 
we would be worried about a domestic actor coming in and stealing chemicals that could 
be used for nefarious purposes. So, again, the month -- or the threat actor focus of CISA 
is all hazards. 

Q_ Got it. 

A It is man-made, foreign, and domestic. It is natural disaster. It is 
technology-driven. 

Q Okay. Let me get to the third prong of the -- what | think you were 
describing as the Russian campaign in 2016. And | think -- does it also track sort of the 


third prong of what you were focused on -- 


A Yes. 
Q_ --froman election security standpoint? 
A Yes. 


Q And what's that? 

A So the third prong is just this broader disinformation campaign that in 2016 
had -- there was an election-related disinfo piece, but there was also a much 
broader -- there continues to be a much broader effort by Russian influence actors to 
destabilize the U.S., to undermine confidence in the American people in their leadership. 


And so, you know, one of those kind of not related to election issues would be, 


24 


25 


27 


you know, they were involved in promoting both Black Lives Matter -- Black Lives Matter 
and anti-Black Lives Matter protests and counterprotests. They boosted some of the 
Kaepernick Nike take a knee sort of stuff. 

But specific to elections, there was also the -- there was also the disinformation 
related to, you know, things that were going on. So Tennessee GOP was a Twitter 
handle, the Ten_GOP was a Twitter handle that the Internet Research Agency based out 
of St. Petersburg used to promote election disinformation in '16. 

So, to step back, we assess that, based on '16, they would continue to use these 
techniques, and they did. And so asa Federal Government, this is where things are a 
little bit looser, because disinformation is, | think, generally a more nascent national 
security risk, that there is not a, for instance, a national security strategy for countering 
disinformation. 

In fact, this is a recommendation that | championed in the Aspen Commission on 
Information Disorder, that the Federal Government needs a whole-of-government 
strategy to understand the threat of disinformation, misinformation, and malinformation 
to the United States. 

And so there is no broad countering disinformation strategy. Instead, the way 
we looked at it -- and this was coordinated through the National Security Council. But 
the way we looked at it was to break up disinformation threats into a supply and demand 
sort of approach. 

And so on the supply side, again, from an unclassified perspective, you would have 
the intelligence community, the FBI, that would be looking to understand who the threat 
actors were. So if it's the Internet Research Agency coming out of St. Petersburg, they 
would be able to then identify the accounts, not the content. It's all content neutral. 


They'd be able to identify the accounts and then say, hey, we can tie this back toa 
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disinformation operator that works for the IRA. Hey, Facebook, Twitter, whomever, you 
guys -- you ought to go check this out and investigate it. 

And so that would then lead to an internal Facebook investigation and that they 
could, you know, expose a coordinated unauthentic behavior campaign. So that's 
disrupting the supply side. 

On the demand side, where CISA sat -- and this is, in part, based on a broader set 
of authorities related to the Department of Homeland Security, as | understood them and 
as | was counseled consistently and constantly throughout the process, but we had an 
awareness and education mission. And so that's the demand side. So, you know, 
seeking to help kind of stabilize or diminish demand for disinformation. 

So that's what led to, in 2019, the release of the -- the War on Pineapple 
campaign, which was -- it was about July, | think, of 2019, where the idea here was we 
would educate, based on our understanding of how foreign influence actors worked. 

We would help educate the American people in a kind of a noncontroversial way. 

So we broke the foreign influence operators’ techniques into five steps. First is 
identify the issue. And|can send you the graphics, the infographics. First is identify 
the issue. 

Second is get your accounts into place. So whether it's Twitter or Facebook. 
Sometimes the seasoning of those accounts can take a few months or even a couple 
years. You saw in '16 that they had had some Twitter accounts they had been using or 
had ready to go for like 5 or 6 years. So, again, the second is you get your accounts into 
place. 

Third is you start boosting the issue that you want to push. Typically, that 
happens on social media platforms and Facebook groups and things like that. 


Fourth is you take it mainstream. That's where you want to take it out of the 
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social media platform into mainstream news and getting it to land on FOX News or 
MSNBC or whatever your target audience is. 

And then fifth is you actually take it to the real world. 

And in '16, we saw them jump from Facebook groups into FOX and others. And 
then you actually had real life protests and counterprotests and trying to get the conflict. 
And, in part, that's what happened with January 6th, right? 

Q Well, we're going to get there for sure. 

A Yeah. 

Q You called it the War on Pineapple campaign. Where does that title come 
from? 

A So, again, the concept here was that we wanted to have an issue that was 
noncontroversial and understanding that there was a lot of national -- you know, anything 
Russia could immediately set off potentially half your audience. So we tried to pick 
something that didn't have any political connotations. 

And so the Election Security Initiative team, again, Matt Masterson and a few 
others, were -- you know, they got everything scoped out and they just had to figure out 
what the issue was to -- that we would mock up. They went to lunch, had -- they were 
trying to figure out what's a binary issue. It's like, you know, do you like salt and vinegar 
chips or something like that. What they actually came down to is whether you like 
Hawaiian pizza or not, and like it's a very clear-cut -- 

Q Yes. 

A It's like you either love it or you hate it. And he is from New York, so he 
probably hates it. Yeah. 

So what we did was that was kind of the -- you know, it's light, it's fun, it's 


engaging. And so that was the point of the public awareness campaign. We released 
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that in, like | said, June or July or so of '19. And then we actually pushed a Twitter -- fake 
Twitter war. And we got National Association of Secretaries of State and the National 
Association of State Election Directors to take opposite sides. One side liked it, the 
other side didn't. Sowepushedit. It caught on. 

And so to the point now where any time anything happens on Twitter where 
pineapple, you know, Hawaiian pizza, pineapple and pizza is an issue, | get tagged. And 
so, you know, it happens at least once or twice a week. So it worked, right? We raised 
awareness at least that pineapple on pizza is gross. 

But to get back to the broader point here, our mission here in the disinformation 
space was to provide information on how disinformation operations work, but also as 
certain themes would emerge related to election disinformation, we would work with a 
range of partners, whether it's at the State level, the Federal level, with the EAC, with the 
Postal Service, with DOD, to provide authoritative information on what happened. 

So I'll give you an example. 2020, October 22nd and 23rd, a series of emails start 
popping up in people's email in-boxes throughout Florida and elsewhere. The emails 
claim to be from the Proud Boys, and they are saying, hey -- and they tend to be targeting 
Democrats and -- registered Democrats at least. And so the claims say, hey, we know 
you're a registered Democrat. You have to change your registration and vote for Trump. 
If you don't, we're going to come after you and we'll know who you voted for. 

And so we saw these coming in. And we -- you know, the way we would 
address -- deal with this, with any of these themes or claims is we would just 
systematically reverse engineer the claim. 

So the claim here is that we will know who you voted for. So it's the law of the 
land in all 50 States of a secret ballot. That's kind of the magic of American elections. 


And so that was the hook for us, to say, these sorts of emails are coming out. The -- it's 
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actually untrue that anyone would ever know who you voted for unless you tell them. 
There's a secret ballot. So disregard, this is disinfo. 

And that was the crux of rumor control, which we launched that Monday or 
Tuesday of the week of 21, 22, whatever it was, October. 

Q  Can!| stop you there for one second? 

A Yep. 

Q Because | know a little bit more about where this story goes, but | want to 
pause on this piece of it for a minute. 

The threat is a -- it's what you would describe as an influence campaign? This 
isn't a physical intrusion into any hardware? 

A _ Yes, right. 

Q_iIt's an effort to influence voters for some -- someone has an objective here. 
They want voters to think a certain thing. 

A _ Soinfluence is kind of -- 

Mr. Walden. I'msorry, hold on. What's the question? 

oY 

Q_ Is that how you would characterize this, as an influence operation? 

A Yes. Thatis an influence operation. | think the -- that's more of a 
technical term that lacks the specificity of the objective. The objective here was to 
intimidate, intimidate voters, scare voters from voting. 

Q Okay. And, initially, you don't know who's behind this, correct? When 
you first learn of these emails, you don't know who's behind these emails? They're 
ostensibly from the Proud Boys, right? 

A They're ostensibly from the Proud Boys. We need to walk carefully here. 


Q Okay, understood. But they're ostensibly from the Proud Boys? 
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A Yes. 

Q_ And you felt that this was something that fit into your mandate, in terms of 
educating the public and addressing potential influence operations? 

A Not only did it fit squarely in our mandate, but it was signed off, not just by 
DHS leadership, but also White House. 

Q Because we've heard from former DHS leadership that there was sort of a 
jurisdictional issue here, in that CISA or DHS was supposed to be focused on foreign 
interference and internet issues, foreign influence or internet issues. Is that your 
understanding? 

A Foreign -- so explain foreign influence in this. 

Q Well, if there were an influence operation, for example, by a foreign 
government, the Russians, say, that would be within CISA's mandate. 

A Okay. 

Q  Butadomestic actor doing the same sort of thing, like the Proud Boys, for 
example, would not be within CISA's jurisdiction. Do you agree with that assessment? 

A | do not agree with that assessment. 

Q- Andat the time that this Proud Boys -- these Proud Boys emails came up in 
the fall of 2020, you said that you had sort of -- you were in alignment with DHS 
leadership and the White House on addressing this false information that was being 
spread in Florida or elsewhere. 

A Absolutely. In fact, we were lauded for our rumor control work that week 
by White House leadership, including the chief of staff and the National Security Advisor. 

Q Now, | don't want you to get into certainly any classified information, but | 
do think you've spoken publicly or it was disclosed that it turns out it was a foreign actor 


involved with the Proud Boys emails. 
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A lt was lran. Yes. And we went from first discovery of that email 11 a.m., 
noonish maybe, when reports came out on Tuesday to standing in FBI headquarters that 
evening, Wednesday evening about 7 p.m., attributing that attack to Iranian -- that 
influence operation to Iranian actors. And | was there in that press briefing. 


Met me pause here. | don't see that we have any members on. 


fe or SR do you have any questions? 
MEE con't, no, 


[Krebs Exhibit No. 1 
Was marked for identification.] 
BY 
Q Let's take a look at exhibit 1 in your binder, which is -- these are prepared 
remarks, testimony that you gave before the Homeland Security and Government Affairs 
Committee of the U.S. Senate in December of 2020. You've obviously seen this 
document before? 
A | may have written it, yes. 
Q Okay. And did you have a chance to review it again before today? 
A Yes, I've reviewed this several times. 
Q Sol want to ask you about a couple of points that you make in here. 
A Okay. 
Q_ And the first one is on this issue of sort of the -- I'm sorry. 
Mr. Luce. | have a copy here. 
By 
Q Some of the issues that are raised by these foreign influence campaigns in 
particular. And on page 2, under "The Initial Challenge," the paragraph says "Initial 


Challenge," you say in the second sentence referring to interference campaigns by the 
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Russian Federation, that: "Whatever their other motivations, these Russian campaigns 
sought to create chaos and division among Americans, implant disinformation, sow the 
seeds of distrust in democratic institutions, and, in this way, degrade America's standing 
abroad." 

A Uh-huh. 

Q  Canyou talk a little bit about how you came to those conclusions that that's 
what they were trying to do -- or the Russians were trying to do in 2016? 

A That is just the broader strategic objective of the Kremlin. And 
disinformation operation is not specific to necessarily just the 2016 election, but that's 
just their strategic approach. And this is not my -- necessarily just my opinion. This is 
the prevailing, | think, academic and, you know, kind of Russia head approach, and it's 
informed by, you know, folks like Thomas Rid, who's a professor at Johns Hopkins. 

But that is -- that is the -- kind of the asymmetric strategy that they're pursuing. 
They have entire units of the GRU that seek to operate in their, you know, European orbit 
to conduct assassinations and things like that, again, to just destabilize the Western-level 
democratic order. 

Q_ And specifically with respect to election issues, were you concerned and did 
you view it as your role to try to combat those types of disinformation campaigns for the 
reasons that you've listed here in the paragraph that we're looking at; that is, to make 
sure that an actor was not able to create chaos and division among Americans, sow the 
seeds of distrust in democratic institutions and so forth? 

Do you need me to repeat that? 

A No. Sothe answer is yes, that is -- that was part of the integrated 
coordinated response to Russian efforts, where there were parts of the Federal 


Government that would more directly take on the activities. But under the assumption 
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that we would not be able to necessarily catch everything and prevent it from happening, 
there had to be kind of a resilience measure. And that was our role, was to help explain 
how these things happen and prepare the American people, inoculate, so to speak, from 
these sorts of attacks. 

Q___I|'m interested in hearing your perspective on why you think that's important, 
why the American public needs to be inoculated, and what the stakes were here with 
respect -- if they weren't. 

A We're in a broader -- okay, so this kind of -- let's step back here again and 
talk about things like the Aspen Commission on Information Disorder that | co-chair. 

The challenge is we're in the midst of an information disorder where 
they're -- disinformation, misinformation, malinformation is flying, due to technology, the 
prevalence of technology, social media, online, you know, enabled communications 
techniques, unlike ever before. It's the velocity of information that's happening, and it's 
being weaponized by all sorts of actors, you know, foreign actors, domestic actors, 
grifters, those that continue to, you know, seek dominion over others. 

And so the point here is that we understood that the -- that the Russians primarily 
were -- but others were doing it too -- were seeking to destabilize the United States by 
undercutting the public's confidence in, not just the national security apparatus and the 
government writ large, but just destabilize or undermine whatever truth is. 

And so part of our mission was, when we understood a national security risk that 
was impacting the United States, it was within the authorities, as we understood it, 
particularly when it came to critical infrastructure-related issues, like election security, we 
had a mission and the authorities to engage and provide explanatory and authoritative 
information to counter, to inoculate, to rebut any of these election-related disinformation 


claims. 
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[11:04 a.m.] 
oy 

Q  Anddo you feel that that understanding or -- 

A So let me -- | want to add one more piece here, again, to explain why this is 
not just election security, this is also about critical infrastructure protection. 

So, in 2020, in probably about April, FEMA actually set up a rumor control site that 
we contributed content to. There were critical infrastructure -- telecommunications is 
critical infrastructure, right? Telephones, internet service providers, anything that 
allows you to communicate. There were claims, disinformation claims, being associated 
that COVID was being spread by 5G and 5G towers. 

It's critical infrastructure. It's disinformation. We worked with scientists and 
telecommunications experts to provide authoritative information to FEMA that they 
could then put on their rumor control site that, as far as | know, is still there today on 
why, scientifically and technologically, that is not possible. 

So that is a -- again, it goes to the broader critical infrastructure mission of the 
Department. Election infrastructure is critical infrastructure. And, as specific 
election-security-related disinformation claims came up, we felt it was important to 
provide, again, authoritative information to rebut some of the claims. 

Q Okay. 

yo 

Q = Can|jump in and just ask -- | appreciate, Mr. Krebs, that the Department did 
and does a lot to counter disinformation by calling it out, identifying it, providing a 
counter-narrative. 


Are there legal authorities consistent with the First Amendment that the 
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government, DHS or otherwise, uses to shut down, stifle, prevent the dissemination of 
misinformation? There are two ways to sort of -- 

A _ Right. 

Q = --combatthis. You can either counter the misinformation with more 


speech, or you can try to shut down the misinformation. Tell mea little bit about the -- 


A | can only speak to what | was involved with at CISA -- 
Q Yeah. 
A -- but we certainly, as far as I'm aware, took no actions as a government 


actor to censor, to -- 

Q Yep. 

A -- to stop any speech. 

Q You're exactly anticipating my question. There is no authority for the 
government to censor, to stifle, to prevent foreign or any actors from disseminating this 
kind of blatantly incorrect misinformation. 

A We -- again, our -- 

Mr. Walden. I'msorry. | just want to make sure, because we have a record 
here, your question is, does he know of any legal authority -- 


v2). 


Mr. Walden. --toshutitdown? Okay. 


=) Legal authority or action to do so. 


Mr. Walden. Okay. 


Mr. Krebs. | am not aware of any action CISA took to shut down speech -- 


yt 
Q_ Right. 


A -- right? -- any direct action we took. 
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There were circumstances where we connected State officials in the 2018 
election, State of Ohio, connected State officials with social media platforms -- 

Q Uh-huh. 

A -- so that, if the State official said, hey, there's a video about a -- there's a 
video on whatever social media platform that seems to show a vote being flipped, we'd 
like to talk to Facebook or Twitter, whatever -- | can't remember the platform -- about 
that and share our perspective and our facts on what's happening in the video, we 
connected them. We had, beyond that, no activity. 

Q Yeah. Sothe purpose of a conversation like that would be so that the 
platform could potentially flag, deplatform, or restrict the -- 

A Do whatever, right. 


Q Do whatever -- 


A Yes. 

Q_ --its terms and conditions of -- 

A With their terms of services, right? 

Q Exactly. 

A Yes. 

Q Okay. 

A But, again, the Federal Government was not taking direct action -- 


Q Yeah, | understand. 

A -- other than connecting parties. 

Q | just want to sort of understand what the various levels are that we, 
collectively, we, the U.S. Government -- 

A Yeah. 


Q -- have to combat this. 
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A So there are other levers that other -- you know, again, I'm not speaking as a 
source of authority here, but, based on my understanding of the research, there are other 
agencies that may have fraud-related -- you know, FTC took action against -- 

Q_ Yeah. 

A -- some of the pandemic grifters for, you know, alternative therapies early in 
COVID. But, again, from a CISA perspective, you know, there are no affirmative 
authorities that we have that we could proactively use. 

Q Okay. That'sit. Thank you. 


Sorry to interrupt. 


No. Noproblem. 
oY 

Q You reference in this document, exhibit 1, several times taking measures to 
protect the public's confidence in the election system in this country. Do you 
understand that to be or did you understand that to be one of the missions of CISA? 

A Restate the question, please. 

Q Did you understand one of the missions of CISA to be to promote and 
protect the public's confidence in the elections in this country? 

A | believe that is a byproduct of our mission, and the mission being providing 
authoritative information on the security of elections to the general public. 

Q And "mission" probably is the wrong use of words there. Was that a goal, 
though, of -- 

A Yes, that was a goal. 

Q  --your group? The goal being to bolster and protect the public's 
confidence in our elections? 


A Understanding that there were adversaries that could target or that could 
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seek to undermine confidence in our elections, we then sought, as a goal, to boost 


confidence in the American public's -- of the American public in our elections. 


Q 


And do you think that goal was controversial within the CISA agency or the 


Department of Homeland Security during the time you were there? 


A 


Q 


> 


Q 
A 


Q 


Within CISA? Not that | -- not that I'm necessarily aware. 
How about in the Department? 

Not that | recall. | mean -- 

Let me ask you another way. 

Yeah. 


Did anyone from Department of Homeland Security ever tell you that 


combating misinformation or seeking to boost the public's confidence in the election 


system was inappropriate or outside your -- 


A 


Q 


> YP 


> Pp 


Those are two different things, what you just said. 

Okay. 

Right? 

Yes. 

Countering misinformation and boosting the American public's confidence. 
Okay. 

So, on the boosting Americans’ confidence in the elections, absolutely not. 
Okay. 


That was never a question. In fact, on election day, | had Chad Wolf at 


DHS -- or at CISA headquarters talking to the American public. We had TV cameras 


there, and he said that it was a secure election -- going to be a secure election, right? 


So, you know, it wasn't just me. That was the nominee for the Secretary of 


Homeland Security. Kirstjen Nielsen, actually confirmed Secretary of Homeland 
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Security, same thing. Kevin McAleenan, Acting, same thing. 

So, you know, as far as I'm concerned, on the maintaining the confidence of the 
American people in the election, that is part and parcel of the mission, right? 

Q Now, you broke out the combating misinformation. So tell me about why 
that might be different. 

A So, again, combating mis- and disinformation is a nascent area within the 
national security community. There are no, you know, clear national security strategies 
around this. _ | think it's the -- | greatly respected and valued my advice from my chief 
counsel and the DHS general counsel team. They were very clear on what was in play 
and out of play. But | thought it was -- given how we understood the threats would 
likely materialize, it became increasingly important, even probably more so than just 
countering the technical threats, that the perception hacks, as they've been called, the 
disinformation campaigns, would likely be the greatest threat to the 2020 election. 

And, you know, this is not just about people on, you know, Twitter and Facebook 
and whatever making false claims or whatever, but this was actually, as we, you know, 
came to believe that it would be the -- sorry. It would actually be part of the techniques 
used by, like, the Iranian actors, that they had, in fact, manipulated -- claimed that they 
had manipulated the election when, in fact, they had not. But it would be their tactics, 
because it's hard to rebut. It's hard to disprove a negative. 

And so that was part of establishing, here are the security -- we never said, "No, 
you didn't." We said, "Here are the security controls in place that would protect the 
electoral process before, during, and after an election that would basically invalidate and 
obviate any claims that they may make. And| have plenty of examples we can talk 
about there. 


Q Uh-huh. Okay. 
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You talked a little bit about -- I'm going to switch gears a little bit here. And | 
might get to some of those examples in a minute. 
A I'd love to talk about those examples. 


Q Actually, why don't you -- 


A All right. 
Q -- tell me about them now. 
A Here we go. 


Mr. Walden. How many days do we have? 

Mr. Krebs. Jim -- I've talked about this. We've talked about this. All right. 

So | think the biggest example here was, as | was in the seat at CISA, right, 
Hammer Scorecard. So it's a claim that was repeated by some of the former President's 
attorneys. Whether they were attorneys or not is unclear. 

But, nonetheless, Hammer Scorecard -- Hammer is the CIA software that -- and 
then Scorecard was the supercomputer -- supercomputer -- flip it around, 
whatever -- that was developed by the CIA allegedly to manipulate elections of foreign 
countries. The claim was that Hammer Scorecard had been flipped around and was 
being used here in the United States to attack election tabulators. 

And so our response here was, again, reverse-engineering the claim. So what's 
the claim? Theclaim is that someone's using a software program to change tabulation 
of the votes. Okay. So-- 

Q Stop for1second. When did that claim first arise in the context of the 
2020 election? | think it might go back before then. 

A | would have to go -- oh, yeah, it does, but I'd have to go back and look -- | 
mean, honestly, I'd have to go back and look at my Twitter feed, but October, sometime 


late October. 
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Q Before the election. That's -- 

A | believe so, but, you know, | don't want to say definitively here. 

Q Okay. 

A It could've been right around -- it was right about that time in November 3rd, 


but maybe slightly earlier. 

So, again -- so, okay, if the claim is that a bad guy comes in and adjusts the 
tabulation, what is the material impact on an election that has robust safeguards before, 
during, and after the election? 

That ultimately is where we got to the point about paper being important. 
Because if you have a paper record of how we all voted in this room and that is virtually 
immutable as it moves through the process, it doesn't matter if there was a computer 
that at some point counted all those things and then changed the outcome, because 
you're also conducting audits on the other side. 

So technology is used in elections to increase the accuracy and the efficiency of 
the process, right? That said, election officials recognize -- this is a concept known as 
software independence -- that you cannot have a computer or piece of software as a 
single point of failure through the process. 

And that's why in Georgia it was so critical that they did, in fact, move from the 
DREs to a ballot-marking device that had a paper record. Because even if Hammer 
Scorecard was correct and the first count of the votes was manipulated by a dead 
Venezuelan dictator, as was claimed, the subsequent counting of the hard copies, the 
paper ballots, showed consistency. 

That software program could not have actually changed the physical paper ballot. 
It could only change the digital tabulation. The recounts proved it did not, though. 


And so our point was: Okay, this is the claim, this is what's circulating. Here, in 
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fact, though, are the security controls and the resilience measures in place. 

And that is essentially how rumor control worked. We would identify the issue 
or the theme that's being claimed, unpack it, reverse-engineer it, and then actually 
provide -- not just say, "And, hey, listen to CISA," but "listen to these experts," the 
national -- you know, the actual State laws, the Federal laws, whatever that is in place, 
the best practice, on how that could not actually change the outcome of an election. 

Q Okay. 

Is there another example you want to share? 

A Sharpiegate. So Sharpiegate is another example in Arizona where there 
were claims that Sharpies were being intentionally passed out in certain voting locations, 
and they would bleed through the ballot and bleed through and fill in a bubble or be read 
as to fill in a bubble on the other side of the ballot if they're double-sided. 

And, in fact, what -- so, first off, you know, what we would do there, we'd see 
that, we'd see that it kind of makes national news or it circulates nationally, so we'd 
contact our -- we either had our on-the-ground people or we would just work with the 
secretaries of state offices. In that case, it was Katie Hobbs and herteam. So this is 
the team Matt Masterson would lead. 

And he'd go talk to Katie and Katie's team and be like, hey, what's going on here? 
She would say, well, here's the claim, and here's the actual -- the technical specifications 
that we have here. And, no, a Sharpie cannot bleed through -- first off, Sharpies are 
approved and have been tested for efficacy. But the second piece here is that, when 
you look at the ballots, there is actually nothing on the other side. The way the ballots 
were designed was that, even if it bled through, there was no scannable field on the other 
side of the bleedthrough. So they were actually offset. 


And so, again, that's the sort of information we can provide out and, again, 
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circulate out to the American public. 

Q And was the -- again, I'm covering something that we've already talked a 
little bit about. But, on that specific instance, no allegation of a foreign actor involved in 
the distribution of Sharpies, right? 

A Not that | recall. 

Q Was there an allegation or a concern that foreign actors were spreading the 
Sharpiegate -- 

A Yes. 

Q- --claim? 

A Absolutely. 

Q_ Andis that what you felt gave you the authority to respond in terms of 
rumor control? 

A | don't think we need -- | don't think we needed that assessment, no. | 
mean, it was disinformation being, you know, associated with an election, with election 
infrastructure, with election systems, and, you know, that, in and of itself, 
election-infrastructure-related disinformation, was sufficient to engage. 

Q = So you didn't perceive that as a State issue that was outside the jurisdiction 
of CISA, to try and address a false rumor about Sharpies? 

A | think it certainly was a State issue, but, you know, it circulates much 
broader than just Arizona, you know, the way the internet works, right? It's not 
confined just to the State. It was, at that point, a national issue. 

Q We've heard from DHS leadership, former leadership, that an allegation 
that's sort of handled by the States would be outside the lane of CISA and, in fact, you 
were going outside your lane by addressing issues such as Sharpiegate or other issues 


regarding misinformation regarding the 2020 election. 
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A Certainly never told by anyone at DHS leadership that we were going outside 
our lane that | recall. 

Q = Other -- | don't want to cut you off on other examples regarding rumor 
control or misinformation. 

A Oh, we talked about -- you know, we talked about the Hammer Scorecard, 
we talked about Sharpiegate, | mean, we talked about secret ballots. 

You know, a lot of the times -- you know, while there were cases where rumor 
control was specifically to emerging claims, we had also done a significant amount of, 
kind of, scenario development and threat modeling, so we had a prepopulated set of 
rumor control entries prior to the election. And we'd actually send them up: You 
know, here's what you might expect to hear prior to the election, here's what you'll hear 
on election day, and here's what you'll hear after the election. But, as specific claims 
came up, we were able to drop in and update new ones. 

Q So, for example, | think you had a rumor control topic on dead people voting 
and how that is not a thing and wouldn't be something that could move an election. 

A | don't think that's how we characterized the response. | think -- 

Q_ That was a gross oversimplification of what was there. 

A So, as we -- yes, there were claims about dead people voting that came 
through. And, again, we don't move to disavow and say, that's not a thing, it doesn't 
happen. The disinformation or the rumor control entry -- and this was coordinated with 
State officials -- was, here are the security controls that are in use to identify dead people 
and remove them from the voter rolls. And, you know, it's including coordination with 
Social Security Office and, you know, the filing of the notice of a death and things like 
that. 


Q Likewise, | think there was a rumor control topic on changes in reported 
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unofficial results in the days and weeks following the election, sort of warning people that 
that might be something that they would see and that they shouldn't be -- they shouldn't 
take too much from that. Again, I'm mischaracterizing -- 

A No, this is -- 

Q_ --a lot of the information that went into the rumor control, but was that a 
topic for you guys? 

A Yeah, we had -- 

Mr. Walden. Yeah, I'msorry. I'm getting a little bit lost, so | apologize for this. 
Maybe it's just me. But it seems to me that you're asking about two different things, 
and | want to make sure you're that -- 

Mr. Krebs. Okay. 

Mr. Walden. -- you're answering the right way -- the correct way. 

One is whether or not the risk assessment for the issue was within his mandate. 
The other one was whether the rumor control about the issue was within his mandate. 
Do | understand your question correctly, or am | misunderstanding -- 

BS «Yeah. Sorry. § It was probably a bad question. I'd sort of moved 
off the mandate issue. Mr. Krebs was going through some examples and sort of racking 
his brain, | felt, looking for them, and I'm giving him some -- I'm trying to jog his 
memory -- 

Mr. Walden. Yeah. 

BE —- on things that I'd seen on the rumor control website. 

Mr. Walden. Right. But examples of things that CISA actually dealt with from a 
rumor control perspective is what -- 


a vc:. 


Mr. Walden. Okay. 
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BY a 

Q  Andisthattrue? Are these things that were dealt with, the things that I'm 
mentioning? 

A To the best of my recollection. 

Q Okay. 

Okay. Let me -- you've talked a lot about, sort of, your relationship with State 
and local election officials. Was that an important part of CISA's work, to coordinate, 
facilitate, assist State election officials in running their elections? 

A To assist in securing their elections, to helping them conduct elections ina 
secure manner, providing them security advice, technical cybersecurity assistance, 
training, education, communications, support. 

Q You talked earlier about the infrastructure and protecting that. How did 
you work with State officials to make sure that their -- to help them ensure that their 
equipment was safe and secure? 

A We had a number of different offerings that we had. There's an entire 
catalog. There's an election security catalog. It's not in here because it's thick. But 
we would go out and conduct things like security and vulnerability assessments. We 
could do red team. We could do fairly in-depth assessments of voter registration 
database configurations. 

We had a, what's known as cyber hygiene scan that they would sign up for and 
we'd do a regular scan to see if anything touching the internet was mis- -- well, not 
misconfigured, but running an old vulnerable version. 

We developed in the summer before the election a product called -- or tool called 
Crossfeed, which was a little bit more in-depth of assessing vulnerabilities of systems and 


websites that are touching the internet. And then we would provide them reports and 
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technical assistance on how they might secure things. 

And, you know, as they received money, we worked, through Federal grant 
dollars, Help America Vote Act, we worked with the sector and government coordinating 
councils to provide grant guidance on, you know, things they may want to invest in. And 
that included things like hiring cybersecurity navigators, cyber navigators, that they could 
put on staff and, you know, provide more technical -- you know, actual their 
headcount -- cybersecurity technical advice. 

Q Did all 50 States and the District of Columbia participate or coordinate with 
you and work with you on infrastructure security? 

A All 50 States participated in some way, some fashion. And it's typically 
through the election infrastructure ISAC in all 50 States. We had thousands of 
jurisdictions -- counties, cities, things like that. 

In terms of, did all 50 States take a security capability? No. But that's not 
dispositive, right? States have different investment levels. They have different organic 
capabilities. They have different requirements. Some States, you know, didn't see a 
need to, because they actually didn't have a lot of electronic or a lot of computer 
infrastructure. They were fairly analogue or fairly remedial. And| think New 
Hampshire is probably a good example of that. 

Other States took every single service we offered, down to mandating it at the 
State level all the way down to the county level. So Ohio, for instance, required every 
single State to take a -- not just sign up for cyber hygiene but also participate in 
a -- effectively it's ared team assessment. | can't remember what it's called at this 
point. 

Mr. Walden. I think you said State. You meant county, right? 


Mr. Krebs. I'msorry. Atthe county level. Every single county had to sign up, 
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not just for cyber hygiene but also down to the red team level. 
BY 

Q Okay. What I'm trying to get to is whether you were able, based on the 
work that you did with the States and the hygiene testing and otherwise, form any 
conclusions, heading into the 2020 election, as to the States' preparedness from an 
infrastructure security standpoint? 

A So our assessment of the security posture of elections was that, to the 
extent that we could get as many States, counties, jurisdictions, whatever you want to call 
them, on paper, voter verifiable paper audit trails, that was ultimately the most resilient 
posture that we could have, so that any sort of technical interference would be 
moot -- mooted by, again, the immutable, auditable record of the paper ballots. 

And -- 

Q_ Sorry. I didn't want to cut you off. 

A So that was the -- that was one of the most significant pushes, was 
encourage and get them the resources necessary to make that switch. 

Q Understood. 

A Yeah. 

Q Were you also able to form any assessment of where the States stood in 
terms of security against a direct hack, for example? 

Mr. Walden. So, I'm sorry, you're asking a very broad question. | just want to 
make sure that I'm clear so that he's clear. You're asking him for his opinion about all 
the States, not whether there's a particular State that's an outlier or there were particular 
States that were vulnerable? 


fF Fair question. 


What I'm trying to get a sense of is whether you had the ability to make an 
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assessment -- 


Mr. Krebs. Right. 


—= -- regarding all the States. I'm not looking for the assessment yet, 


Mr. Krebs. Right. 

= -- | can envision the answer that, well, you know, we never really got 
into New Hampshire, so | can't tell you about New Hampshire. 

But, you know, were you able to form impressions -- yeah, go ahead, John. 

Mr. Luce. | guess one thing | was trying to understand is if you're asking, like, if 
the Department established that or if you're asking, like, for his personal assessment. 

At some points, it's getting a little bit confusing as to whether you're asking, like, 
his opinion, like, almost like an expert-type opinion on something, or whether we're 
getting to, like, what the Department knew or thought at the time. 

So | just wanted to make that point and try and clarify for the record where we 
are. 

Sa Great. Thankyou, John. | will try and clarify that. 

By 

Q___ It appears from your prior answer that -- or answers -- that it was critical, 
from CISA's perspective, to try and move as many of the jurisdictions as possible to paper 
ballots for all the reasons that you've said. 

A Uh-huh. 

Q = Amlright on that? 

A That was -- yes. 

Q Okay. 


| know it was also, based on your answers earlier, a goal of CISA to assist States in 
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ensuring that their -- not just States, but the jurisdictions -- that their equipment was safe 
and secure, right? 

A _ Right. 

Q_ And you talked about hygiene tests and other opportunities that you 
presented to these various jurisdictions they could avail themselves of or not to sort of 
test the equipment and make sure that they were as secure as they could be from an 
infrastructure standpoint, correct? 

A So, to step back, our job here was to build relationships with State and local 
election officials who were, under the Constitution, as delegated by their State 
legislatures, responsible for administering elections. We were there to help them do so 
in a secure way. 

So we'd build the relationship; we'd provide the resources that they need, 
understanding that they have other resources. A lot of other States, counties, had, for 
instance, FireEye and CrowdStrike and other things like that. If we determined or they 
asked, "Hey, we don't have this capability," we could provide that. 

Now, am | going to say right now that | have a full understanding of all 50 States 
and whether they were anAoraBoraCoranF? No. That's not -- you know, | don't 
have that understanding right now today. 

So, all of that said, we also -- we're in the risk management business. So 
100 percent security was never the objective here. The objective was a resilient election 
so that, even if a technical attack by the Russians, by the Iranians, was successful and they 
could infiltrate a voter registration database or whatever, it wouldn't matter, because, 
again, the security safeguards in place would protect the integrity of the vote, the ballot, 
all the way through the certification process. We had the utmost confidence in that 


workflow. 
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Q Understood. Understood. And I'm going to -- 

A | know -- all right. 

Q- -- goa little more -- I'm going to push you a little more just to see if | can get 
an estimate from you onthis. But what I'm interested in understanding is, from a CISA 
perspective, not Chris Krebs as an individual, whether your level of penetration, level of 
cooperation, from the various jurisdictions with respect to this, these testing measures 
that you offered, sort of how broad that reach was, to the point where you could say, for 
example, in 50 percent -- I'd say, you know, in half the States in the country, you know, 
we worked with them and we're pretty confident, based on the work that we did, that 
their systems were not impervious but pretty secure against a direct hack, but a lot of the 
States didn't avail themselves of that, so | don't have visibility. 

| mean, that's the kind of assessment I'm trying to get in terms of what CISA's 
visibility was or confidence level with respect to the security of the infrastructure in these 
States. 

Mr. Walden. Yeah. And 1 don't want -- 

ae And if this is impossible, then just tell me, and I'll move on. 

Mr. Walden. Yeah, | don't want to be a stick in the mud here, but maybe it'd be 
a good time to take a little bit of a break. Are you talking about while he was there 
before the 2020 election? 

ae v:. 

Mr. Walden. Okay. 

«you want to take a break? ~Wecan. Talk about it? 

Mr. Walden. Yeah, why don't you let us talk about it. 


That's fine. 


Mr. Walden. Okay. 
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That's fine. 


Mr. Walden. By the way, is there any place around here that has coffee, like, 
immediate to this room? 


Ws There's a place in the basement. 


Mr. Walden. Oh, no, no. 


But it's not -- 

Mr. Walden. — It's not, like, there. 

EE (No, unfortunately. 

SS | can you click this over there -- 
Yeah. 

= -- if you remember how to do that? 


Cc Okay. We're going to go off the record now. 


[Recess. ] 
fF Okay. We're back on the record with Mr. Krebs. 
BY 

Q_ So, Mr. Krebs, we've talked a lot about efforts made by the Department, or 
the Agency -- excuse me -- heading into the 2020 election. | want to talk a little bit now 
about your perceptions and understanding of how things went from a security standpoint 
with respect to the 2020 election. 

Do you -- let me ask this way. We've talked about the various measures that 
CISA took and the work it did with State and local election officials in attempting to 
secure the election. Do you have a view as to whether your efforts were successful in 
terms of preventing cyber intrusion in connection with the 2020 election? 

A So | believe three things. First is that we improved the security of the 


systems across the country in general, through providing technical assistance and 
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services, tools, education, and awareness. So that's point one. 

Point two is, | think we, more importantly, helped to improve the resilience of the 
system where, even if there was a successful attack, that it would've not fundamentally 
had animpact. Paper, again, resilience, the systems, that was the ultimate objective 
there. 

And | think, third, and probably, you know, most significantly as we came around 
to understand, is that | don't ultimately believe that it was the objective of any adversary 
to change a single vote in the election. | think their objectives were more to sow chaos 
and undermine confidence in the process. 

Q Are you able to form any conclusions as to whether there was a cyber 
intrusion in connection with the 2020 election? 

A Yes. In fact, we released alerts on these things throughout. There were 
both Russian and Iranian actors that were able to gain access to election-adjacent 
systems. The lranians, in one case, | think, had access to a voter registration database. 
But we're not aware of any instance where they were in a system that would've been 
directly connected or, you know, involved in casting, counting, certifying of votes. 

Q You're speaking specifically of the Russians in that last answer? 

A Both. Anyone, any actor -- 

Q Okay. 

A -- that would've been able to change a vote or change the tabulation of a 
vote. 

And there are CISA and FBI alerts on both Russian and Iranian actors. | think 
those are sequentially dated, like, the 27th and 28th of October, something like that. 

Q And with the Russians, | think the public information was that they gained 


access to voting records or some sort of voting registration records? 
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A The -- again, this is over a year -- they had access in a county in the Midwest 
and a county on the Pacific Coast, at a county level, in a voting office, but it was 
effectively derivative work product. So| would think about it more along the lines of, 
they had access to a merge mail file for voter -- it effectively would be like sending a voter 
postcard, like, "Remember, here's your voting location," that sort of thing. 

Q And had there been public reporting of some sort of intrusion by the Iranians 
before the election? 

A That was associated with the Proud Boys campaign. | would think about 
this less of a single action, of a set of emails, but more of a coordinated campaign. You 
know, I'd point you again to the joint CISA-FBI alert that talked about how they had access 
into a State level -- again, I'd have to go back and look at the alert of exactly what the 
system it was. But, again, it had nothing to do with the actual process of casting, 
counting, or certifying the vote. 

Q Have you seen any evidence of cyber interference along the lines of casting, 
counting the votes, with respect to the 2020 election? 

A No. 

Q Have you heard any reputable scientist or electronic voting expert conclude 
that there was cyber interference or manipulation of votes with respect to the casting or 
counting of votes in the 2020 election? 

A No. 

Q__Inyour binder, at exhibit 2, there's a November 16, 2020, statement -- 

A Yes. 

Q_ -- signed by 59 -- not signed but sort of electronically or listed as having been 
signed by 59 different specialists in election security. 


Have you seen this document before? 
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A | have. 

Q Okay. Do you know some of the people who are listed on the second and 
third pages of this document? 

A Ido. | know anumber of them. 

Q Okay. And is your understanding that these are, indeed, experts in the area 
of election security? 

A These are the experts in election security and computer security in the 
United States. 

Q Did you see this statement at the time that it was issued? 

A  ldid. 

Q Is there anything in it that you disagree with? 


A Nothing at all. 


Q___ Did you play any part in the preparation of this document? 

A Preparation, no. 

Q How about distribution? 

A | tweeted about it. 

Q Okay. 

A In fact, | quoted a line. 

Q Do you remember what line that was? 

A Yes. | think the tweet was something along the lines of, you know: 59 


election security experts all agree, in every case of which we are aware, these claims 
either have been unsubstantiated or technically incoherent. 
Mr. Walden. The first page in the fifth paragraph. 


Mr. Krebs. Yeah. Sorry. Halfwaythrough. Starts with "however." 


CY 
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Q  Gotit. Thankyou. 

Let me step back again to before the election. Were you keeping others within 
the government apprised of CISA's efforts to help secure the 2020 election? 

A Within the Department? 

Q Within the U.S. Government. 

A Oh, absolutely. 

Q Were there interagency meetings on those topics? 

A There were frequent interagency meetings. 

Q Which -- and, again, I'm going to tread carefully here. | certainly don't want 
to get into any classified information, but let's just start with who -- if you can say, which 
agencies participated in the frequent briefings or -- 

A Okay. 

Q Maybe a better way to ask that is: Which agencies did you brief on election 
security efforts leading up to the 2020 election? 

A So | think there was -- let me put a real quick, kind of, framing around those 
meetings. There were separate meetings through separate channels. 

So there's a National Security Council process that's run by an SPM-4 (ph). And 
that starts with a -- whatever -- a PCC, so a policy coordinating committee, or a sub-PCC, 
that works its way up to a deputies committee meeting and then goes to a principals 
committee meeting. 

So, at the PCC level, it's typically assistant secretary level -- supposed to be, but it's 
probably a little bit below that. Deputies committee meeting is either deputy 
secretaries of departments or, in some cases, agency heads that are sub-department. 
And at the principals committee meeting, that is as established in the National Security 


Act, and that tends to be agency heads. 
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So that is the formal process that's run by the White House through the National 


Security Council. 


There is a separate coordinating process from an operational agency perspective 


that was -- and you had in some of the production that | saw, some of the calendar 


invitations that talked about principals commit- -- or principals -- | don't know if you have 


it in here. 


Q 


A 


| don't think it's in the binder. 


So it was principals SVTC. 


| don't know if | see it in here, but -- 


Q 


A 


Yeah. 


-- it was definitely in some of the stuff that | saw. 


So, anyway, in the principals SVTCs, those were coordinated or run by the Director 


of National Intelligence, ODNI. 


Mr. 


Mr. 


Walden. Can we just stop -- 

. Krebs. Yeah. 

Walden. SVTC? 

. Krebs. SVTC, secure video teleconference. 

.Walden. Thank you. 

. Krebs. Didn't you work at DOJ? 

.Walden. Yeah,!Idid. | just like to have a clean record. 
Krebs. Right. 


And those would happen -- again, I'd have to refresh my memory, but those 


started in 2019 to 2020, early, and then ran through maybe about the summer or so, or 


the late summer. And those were -- so the principals committee -- or the, sorry, the 


principal SVTCs were run by whoever was leading the Office of the Director of National 
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Intelligence. 

Now, when Rick Grenell came in, those meetings dropped off. We didn't do 
them anymore. Nor did we do the deputies level, which was -- so the principals were 
about every month, and the deputies meetings were about every other week, so every 
2 weeks. 

And so those started with, at the deputies level, Coats and Sue Gordon. _ It really, 
| think -- yeah, it started at the tail end of Coats' and Sue Gordon's tenure, and then 
Joe Maguire and Andrew Hallman. And then, when they left in late February, which is 
about when they were shown the exit, and Grenell and Kash Patel came in, we didn't -- | 
don't recall ever being in a meeting with Rick Grenell or Kash Patel about election security 
stuff. 

So that was -- but they were still happening at kind of the lower staff level. And 
Shelby Pierson was leading those discussions on behalf of the DNI with Bill Evanina, who 
had been tapped at the tail end of the -- you know, in the interregnum, basically, after 
Coats and Maguire, that period. 

Q_ And, just to stop you there, in the context of these DNlI-type briefings, were 
you sharing CISA's efforts on election security and what the agency was doing? 

A Absolutely. We were sharing -- | mean, we had a very prominent role in 
updating what we were doing at the State level, the sorts of meetings that were 
happening. There wasa big roll-out and a communication strategy. There were public 
events. You know, this was at the level of -- you know, in February of 2020, I'm going to 
San Francisco to keynote the RSA conference, the largest cybersecurity conference. 

Like, that's the sort of detail, as well as, well, we've got a tabletop exercise, we have this 
sort of meeting. 


But it was not just those were updated in the meetings; there was a tracker that 
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was maintained at the staff level across the agencies, as well back up to the National 
Security Council through the PCC. | think they actually called it an IPC, but it doesn't 
matter. 

So that was that operational coordination piece that, over time, as we got closer 
to the election, | think the responsibility of leading the regular engagement shifted from 
this DNI-driven effort to a National Security Council coordinated effort at the sub-PCC 
level. And so those were run by -- the name escapes me right now, but it was a -- | 
believe it was a DHS detailee to the National Security Council Resilience Directorate, 
which, at the time, the senior director was Brian Cavanaugh. 

Q Okay. 

And it sounds like, either through the briefings or the tracker or other mechanisms 
or maybe just, you know, operational collaboration, you were keeping other agencies in 
the executive branch pretty well informed as to the measures and the initiatives that CISA 
was undertaking. 

A Yes. And they shared back with us. And it was DNI, FBI, Cyber Command, 
Department of Defense, the CIA, and anyone else in the intelligence community that 
wanted to share. Those were generally the players in that DNI-led effort. 

And then, as that transitioned over to National Security Council, it was a similar 
cast of characters. 

Q How about the White House directly? Were you keeping the White House, 
through a liaison or otherwise, apprised of the initiatives and measures that you had 
underway, so tabletop exercises that you've talked about, rumor control, things of that 
nature? 

A My -- because | did not -- you know, my team, staff, worked directly with the 


National Security Council through the PCC process, and | was not involved in those 
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conversations. They were staff-level, weekly. | think it was, like, every Tuesday, they 
would have meetings with the White House. But those conversations had all the 
information. And there were, as far as | know, White House representatives, you know, 
politicals, that had access to that information. 

Did | directly update the White House? No. 

Q Did you ever get feedback, either directly or through your staff, about 
concerns that the White House had about efforts that CISA was undertaking in the 
election security area before the election? 

A So the concerns that | heard -- again, nothing came directly to me from the 
White House. In point of fact, | made it clear that if there were concerns they had to 
cometome. But that there were some concerns through the, kind of, the political 
apparatus, and whether it was from the White House or the White House liaison at DHS, 
but there were concerns about a product we released in June or July of 2020 about 
security -- oh, a risk assessment of mail-in voting and the security controls that were in 
place. 

Q What did you understand the concern to be? 

A So, as it was fed back up to me from staff is, why are we providing guidance 
on whether a form of voting that the President has said is insecure -- why are we saying 
that here are security controls for it? 

And my response to that was, if someone has a concern with that product, they 
will come talk to me about it and we'll have a discussion about whether it stays up or 
stays down. Nobody ever came to me. 

Q So you heard that concerns had been raised. They were described to you. 
But you didn't take any action with respect to those, and you never heard directly from 


the people who were concerned. _ Is that -- 
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A _ That is accurate. 

Q- --fair? Okay. 

A | was -- you know, | had the -- as the Senate-confirmed Director of the 
Agency, it was my responsibility to make decisions of what was up and what was down. 
And | was not going to, you know, put that decision authority in subordinates' hands. 
That was mine. 

Q Do you know that -- I'm going to ask the question this way. Did you know 
that, in fact, some information regarding mail-in voting was taken down or redirected? 

A After the fact, | was informed that stuff may have been taken down, but it 
was, as | understand, put back up. 

Q = Other than this concern that got to you indirectly regarding the 
mail-in-voting directive, any other concerns that were raised with you -- 

A Let me add one more little addendum to that last statement. 

So | made it completely clear that | was the one in the Agency that was making 
decisions on what stayed up and what stayed down -- or what stayed up or what came 
down. Andsol| think, as that percolated through, perhaps that's what led to, oh, this 
goes back up. 

Q Okay. 

Other than the concern that got back to you regarding mail-in voting, any other 
concerns ever brought to your attention, either directly or through staff, that the White 
House had about election security efforts being undertaken prior to the election? 

A Not that | recall. 

Q  Oranyconcerns about statements that CISA was making publicly in 
anticipation of the election? 


A Not that | recall. In fact, many of our statements were encouraged by the 
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White House, like encouraging voters to be patient, that results may take time to come in 
and the official results are not until December. 

Q Were there other aspects of CISA's work that you were encouraged by the 
White House to more broadly publicize? 

A In fact, we had a campaign known as "Be a 3P Voter." Be prepared, you 
know, because things are changing with COVID, know where you're supposed to vote. 

The second is be a participating voter, because there were a lot of concerns about 
elderly voters or elderly election volunteers, because of COVID, not being able to 
volunteer. So they wanted to get people to volunteer to work polls. 

And the third is be a patient voter, purely because the increase in mail-in voting 
would take a longer lead time and it would take more time to work through. 

And so that point specifically, be a patient voter, was briefed out numerous times 
in White House meetings and with full endorsement to continue pushing that message. 

Q | think I've heard somewhere that, at one point, the President suggested to 


someone who worked for you that there should be more publicity of the successes that 


were -- 
A Yes. 
Q_ -- generally of the successes of the Agency. Correct? 
A | believe that was expressed to Matt Masterson in the Oval Office on Friday, 


February -- what was that -- 14th? | was in Munich, sol don't know. But -- 

Q_ And specifically with respect to the positive trend that you've talked about 
towards paper ballots, correct? 

A The President, in his own public statements, encouraged paper, yes. 

Q But was there a request that CISA be more outspoken about this 


accomplishment, with respect to the encouraging and facilitating the move to paper 
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around the country? 

A What are you -- are you asking that we get out there and talk -- that we were 
to get out there and talk about how we've increased the resilience, or how the President 
was responsible for increasing paper? 

Q_ Either. 

A So, you know, that -- | was not in that meeting. Matt Masterson was. _ It 
was not a surprise to us; he had been a constant supporter of paper ballots. And that 
message kind of, | think, trickled through the White House, that, you know, as a 
government, we need to get out there and talk about our successes in making the 
election secure. And we did that. 

Q  Soyou had a specific, very specific, recollection in mind in terms of the date, 
time, and place and individuals. Are there other examples of that that you're aware of 
where word got back that the President wanted you to promote or tout a particular 
success of the Agency? 

Mr. Krebs. Do you have any concerns? 


——SSSs | don't want to -- 


Mr. Luce. Can we just have a quick -- 


BS «Yeah. Let's go off the record. 


[Recess. ] 
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[12:13 p.m.] 
BY 

Q Okay. There may have been a question pending, but I'll withdraw it. Let's 
move on. 

A All right. 

Q Mr. Krebs, in your last -- one of your recent answers, you mentioned sort of 
issues raised by the pandemic and COVID concerns. Was that -- did the pandemic in 
the -- leading up to the November 2020 election create certain challenges, from an 
election standpoint? 

A __ Yes, there were a number of challenges introduced. One, you had delays in 
holding of primaries. You had, you know, certain safety measures introduced at polling 
locations, like baffles, masks, pencils, separation 6 feet, things like that. There were 
concerns about whether COVID could be transmitted on paper ballots and things of that 
nature. 

And so one of the -- again, consistent with that kind of all-hazards mission of CISA 
in the critical infrastructure protection and resilience space, we early on both worked 
with our State and local election officials and the HHS and CDC, so that they could provide 
election-specific guidance to election officials, so COVID election-related specific 
guidance. 

We also connected State and local election officials with the post office to talk 
about some of the security -- or the concerns about potential COVID impact on the 
election process. And, | mean, | think that's generally it in the spring. 

Q Are you familiar with the term "swimlane documents"? 


A Now that | -- that you mention it, | haven't heard -- | haven't heard that term 
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in a while, but yes. 

Q What were swimlane documents? 

A | -- those documents, as | recall, were for staff to have a clear understanding 
between -- actually, I'm going to -- | don't believe | have a recollection that | would 
be -- feel comfortable, you know, recalling exactly what that document was, because | 
don't remember if it was for specifically the election side or the interagency side. 

Q Okay. Prior to the election, did you become aware of any -- what -- and 
this is a Chris Krebs personally question. Did you become aware of any information that 
you would consider misinformation regarding the upcoming election that was being 
disseminated by the White House, by the President or his spokespeople? 

A What's the timeframe again? 

Q Leading up to the election, at some time prior to November 3rd. 

A | think generally the -- the mail-in ballots would be rife for foreign 
interference, that foreign actors could mail in a bunch of fake mail-in ballots. | mean, 
that's just one example. 

Q_ There wasa press conference that I'm recalling, | can't give you the date, 
where an issue of ballots being found in a river in Wisconsin came up. | think the 
President might have said that. Don'thold metoit. But! know his spokesperson 
addressed that issue prior to the election. Do you remember that? 

A | recall the instance. | don't recall exactly what -- when that was or what 
we said about it, if anything. 

Q Okay. Well, the last part is what | was most interested in, is whether there 
were any efforts within CISA to address claims that had been made by the President 
regarding the upcoming election that people within your agency might have believed to 


be false? 
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A Again, when you go to the philosophy of rumor control, it was to identify 
themes. It was not rebutting specific examples or statements by any individual. 

Q We've seen some documents that were produced by DHS relating to efforts 
to connect with social media platforms, Twitter, for example, to working with State and 
local officials to try to address claims that were being made on Twitter that were false. 

A Uh-huh. 

Q Are you familiar generally with that initiative? 

A | think generally, yes. And | gave an example of the 2018 election, at least, 
how we were able to connect | think it was Ohio with one of the platforms. 

Q_ And it seemed as if that was a fairly robust -- | was going to say operation. 
That's probably too strong a word. But there was a fairly -- it looked to be, from the 
documents I've seen, a fairly well-coordinated effort to put State officials in touch with 
the social media platforms and try to provide the information necessary to address what 
were false claims in their respective jurisdictions. 

A | think certainly the efforts to make those connections was a priority. We 
had frequent -- | think it was monthly -- at least monthly -- | think monthly, let me put it 
that way -- meetings between interagency partners, so FBI, DNI, and CISA, with 
representatives from the social media platforms. And we sometimes did those out in 
California. You know, | would attend every now and then some of those meetings. 

Now, State and local partners were not there. This was just making sure the 
Federal Government and the social media platforms were connected and were sharing 
kind of our understanding of how things were playing out, what our concerns were. 

Q Were you generally -- are you aware of the general process if, for example, a 
tweet was posted about a particular claim in a particular State, what the process was to 


try to -- that might lead to either addressing it or deplatforming the person who had -- 
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A No. 

Q  -- made the tweet? 

A No. | was not -- | didn't have kind of visibility into the mechanics at that 
level. 

Q Okay. Do you know whether CISA played any role, for example, in helping 
secretaries of state formulate a rumor control type of response to those -- those 
instances? 

A Meaning their own responses at the State level to -- | -- | don't know for 
certain. | wouldn't be surprised, but | don't know for certain. 

Q | mean, I can see that those types of responses -- when | say types of 
responses, there were responses coming out of various State -- from various State 
election officials akin to what you've described with rumor control. 

A __ Right. 

Q  Sonot necessarily debunking, but sort of promoting sort of true facts that 
the public should be aware of. And I'm wondering whether CISA played a part in that or 
that was just sort of training and they would sort of do their own thing. 

A | don't believe -- | don't recall any specific training to States in advance of 
elections on, you know, how to counter. Rumor control kind of came up more 
organically than that. 

| do recall -- | can't give you a specific here, but if there was a State-specific claim 
that | would ask or | would be asked -- it's in the bits here -- about, hey, this -- I'm seeing 
reports of this, what -- what's going on? 

And so what we would tend to do is ask the State officials, say, hey, what's 
happening in this issue, is there anything you can share, do you have a statement? And 


then | could take that statement and send it to the Acting Secretary or the White House. 
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We would send it to the White House. 

Q Okay. Did you ever interact with a person named Josh Whitehouse? 

A Yeah. He was the White House liaison before he went -- for DHS before he 
went to DOD, yes. 

Q Did you have personal interactions with him? 

A | talked to him a handful of times. He interviewed me, and | tried to get 
him to not take personnel action against some of my employees. 

Q He interviewed you in what context? 

A So in the press they've been dubbed loyalty tests, but he -- in 
the -- throughout the course of 2020, as | understand it, at various departments the 
White House liaisons were to interview staff to, you know, in part say, hey, what do you 
want to do next term. But, you know, there were other cases where | think they were 
asking about operational issues and, you know, what your coworkers are like. 

Q What types of questions were you asked? 

A | don't recall other than, you know, it was a fairly -- so | don't 
think -- actually, Josh was not in my interview. It was Troop something that 
was -- Cooper something, | don't know, that was -- he conducted the interview. And it 
was background questions, you know, what do you want to do, and things like that. It 
was -- 

Q  SowithMr. Whitehouse, did you ever have discussions with Mr. 
Whitehouse in which he expressed concerns to you about any aspect of what CISA was 
doing? 

A Not that | recall about any of our actions. He had concerns about people 
that worked for CISA as politicals. | don't know if I'm -- is this in play? 


Mr. Luce. | think at this level -- 
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Mr. Krebs. Okay, okay. 
BY 


Concerns about people who worked under you? 


Pp 


> 


Yes. 

Q_ And their loyalty to the President? 

A | think it was -- that's, you know, one way to characterize it. | think it was 
just general -- yes, loyalty to the administration. 

Q Did anyone -- prior to the election, did anyone from DHS leadership ever tell 
you that your job was in jeopardy? 

A It wasn't so much that | recall specific instances. It was just that there 
was -- so just stepping back, and you see it here inthis. I'm holding the Krebs strategy 
that was posted publicly on Twitter by Jonathan Karl. 

You can see in here that there's a line that says -- you know, assuming this is, in 
fact, real, it's consistent with my understanding of how the White House personnel office 
under John McEntee viewed -- "Maintains a close and personal relationship with Nielsen." 
So there's just this broader theme that we were part of the John Kelly-Nielsen cabal, and 
that was a bad thing. 

So | was aware that there was, you know, some skepticism of my loyalty to the 
President. 

Q How did you become aware of that? You didn't have this document, the 
one that you just -- 

A | didn't have that document. | think -- again, | can't tell you specific people. 
It was just kind of the whisper net. | knew that, for instance, that they wanted to fire 
Bryan Ware, and they did fire Bryan Ware. 


Q "They" being who? 
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A The PPO, White House. Not Josh Whitehouse, but he was the vessel for 
that, but it was the Presidential Personnel Office. In fact, they tried to fire him the 
summer of 2020, and then | was able to convince them that it would be in the President's 
best interest to keep him on until after the election. 

Q But with respect to you personally, you had a sense that you maybe were 
perceived as less than completely loyal to the President? 

A | think it was -- again, | can't point to any specific conversation or person, but 
it was, you know, the profile. Nielsen, Bush administration, you know, didn't serve on 
the campaign or anything like that. And, you know, so that kind of led up to it. And, 
again, | think there were comments made over periods of time, but | can't say it was any 
specific person. 

Q Were you ever told that there were -- other than -- we talked about the 
mail-in voting piece. |'m not even sure this would fall into that category, but were you 
ever told that there were concerns at the White House about how you were running the 
agency? 

A Never. 

Q Were there any specific measures or actions that you took that you received 
feedback that was -- that those actions were not well received at the White House, other 
than what you mentioned before about the mail-in voting guidance? 

A So after Claire Grady left, which was 2018 -- what was that, March of 2018? 

Q Whois Claire Grady? 

A Claire Grady was the Acting Deputy Secretary. She was the 
Senate-confirmed Under Secretary for Management who was -- who served as Kirstjen 
Nielsen's deputy. 


After Claire left, | didn't have any formal performance evaluations. Sol went, 
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you know, 2-plus years, 2 and a half years without a formal performance evaluation. 

And there was no other mechanism that | received any feedback on my job performance, 
how | was managing the agency, other than laud, you know, very confident feedback, in 
fact, from Kevin McAleenan, from Chad Wolf, that, you know, we were doing -- you know, 
we're -- they don't have to worry about us, basically, because we're running a tight ship. 

Q  So--I'm not just confining this to sort of a formal job evaluation, but did 
Mr. Wolf ever tell you on any particular issue, you know, there are concerns about how 
you've handled that issue, concerns at the White House? 

A What issue? 

Q  Onany issue. 

A | am not -- | don't recall any specific conversation | had with Chad that | could 
pin back, point back to. | think there was, again, a general sense that, you know, | 
wasn't necessarily perceived very positively in the new PPO. 

Q Based on your background profile and former sort of affiliations, but not 
necessarily based on particular work you had done or decisions you had made, as you 
understood it? 

A That's as | understood it, right. | just don't think there was necessarily a 
science to any of this. | think it was all very vague and -- 

Q Okay. And I'm not asking you to sort of read what other people were 
thinking or that. I'm focused here on whether you were ever told specifically there is a 
concern about how you handled this or that situation? 

A | was never -- as far as | can recall, never counseled on any specific issue or 
decision! made. | had a general sense, though, that | was not on -- viewed as being on 
the team. 


Q And|asked specifically about Mr. Wolf. | want to also ask specifically 
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about Mr. Cuccinelli. Did he ever share with you that there were concerns about how 
you were handling any particular issue at CISA? 

A Any particular issue? No. 

Q  Orconcerns that the White House is not happy with the way you handled a 
particular issue? 

A On any particular issue, no. 

Q How about the general concept -- this is from Mr. Cuccinelli -- the general 
idea that you were getting outside of your lane in some actions you were taking on behalf 
of CISA? 

A | was never informed or told or counseled or advised, to my recollection, 
that | was getting outside of my lane. 

Q | want to turn my attention now to election sort of -- this is sort of leading up 
to the election. Now| want to talk about election day a little bit. 

What was CISA's role on election day? 

A We hosted at -- at CISA headquarters in Arlington the -- kind of the war 
room. In fact, we had -- so that was November 3rd, Tuesday. | think we spun it up. 
The virtual room was up and running the week before, | think Thursday -- no, maybe 
actually like Tuesday, Wednesday, Thursday before. We had people in the office 
physically, even in the middle of COVID but in COVID safe protocols, on | think starting 
Monday, maybe even Sunday night. And that ran through Wednesday. 

We kept the virtual where virtually | think every State. We may have had like 47 
or 48 States dial in throughout, but that went on. That was like a week or two in 
advance to a week or two after, almost | think through certification. 

But on election day, we had operational representatives from the FBI, the 


intelligence community, State and local election officials. | think we had representatives 
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from social media companies, and we had representatives from election equipment 
vendors. Cuccinelliwas there. So Chad Wolf was there inthe morning. Wedida 
press conference. There was pressthere. Cuccinelli came in the afternoon. 

Throughout the day, | think every 3 or 4 hours, we did press calls where national 
media would callin and ask us questions. But it was, as | said at the time, just another 
Tuesday on the internet. 

Q What was the role of -- you had this structure set up. Talked about sort of 
who was there. What were you -- what were your -- what do you perceive as your role 
that day or night? 

A So -- allright. Generally, we were coordinating massive amounts of 
information as they were flowing across the country. So, you know, hey, there's an 
issue in whatever county, Georgia, what's going on there? _ It's hitting national news. 

So it's basically like a watch function. _ It's like, hey, we're seeing reports that this 
thing happened. And then we make a call down to the State and say, hey, getting 
reports here, what's happening? Oh, a backhoe cut a fiber line going into an election 
precinct and they've lost internet connectivity. Okay, all right, let us know when it's 
back up. 

Q_ And the goal of that -- the local jurisdiction is obviously aware of it, that's 
who you're getting your information from. They're dealing with it. What's 
CISA's -- why is it important that CISA be advised of -- 

Mr. Krebs. Hanging in there? 

Mr. Walden. Yeah, yeah. I'm going to need a break for a minute to just walk 
down the hallway. | apologize. | don't mean to -- finish this line of questioning. | just 
need to walk for a minute. 


Mr. Krebs. Decision support, in part, to leadership at DHS or at the White House. 
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Second is operational, you know, informing operations if there's anything 
suspicious. 

You know, what we really wanted was that if any State or local government saw 
something suspicious happening, that they would immediately inform us. 

And so there was a case where a State -- it's in your tracker that | was provided, 
one of the exhibits that had the kind of the day of. And think this was one that Melika 
passed to Cuccinelli that -- anyway, it's a tracker. It's an Excel spreadsheet. 

And there was a State, Delaware observed an unknown actor trying to exploit an 
Oracle database vulnerability that they had had patched. So what we were able to do is 
Delaware let us know. We said, that's interesting. But because we were integrated 
with the FBI and the intelligence community and others, we could actually say, hey, 
guys -- so it wasn't just for our benefit, like | said, decision support. We were able to 
share it with our operational partners for them to go do whatever they need to do. 

So it was a functional operational watch cell, also coordinating situational 
awareness, coordinating action. And that was -- and that was the day. 

SSS Let's go off the record. 

[Recess. ] 

BS soOkay. We're back on the record. 

BY 

Q Mr. Krebs, did you make any public statements -- and this is you 
personally -- make any public statements regarding election security in the days following 
the election? 

A While | was still a CISA employee or after? 

Q_ Yes, in the days immediately following the election. 


A So on the -- obviously, November 12th was the joint statement, the GCC-SCC 
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statement. 

Q Let me stop you right there. I'm talking about before that. On the 3rd, 
Ath, 5th, were you making -- did you make any public statement? 

A | think -- yeah, | think even on election day, as | just -- | just said, you know, 
we've said that it was just another Tuesday on the internet. So we didn't see any 
activity on that Tuesday on the immediate aftermath that would have suggested there 
was any sort of security issue associated with the election. 

Q Just another Tuesday, that was a tweet from you? 

A No. |said that on the press call that was then quoted in an article. | don't 
recall exactly -- | don't remember who exactly quoted it, but it was to a -- we did all those 
calls on background. So it didn't get attributed to me, but it was me. 

Q How about Mr. Wolf, was he -- did he make statements either on election 
night or in the immediate days following? 

A Astrecall, you know, that morning, he said that it was a secure election. | 
think even afterwards | think he said it was the -- you know, echoed my statements of it 
being a secure election. 

Again, | don't know the -- | can't tell you the specific day or venue or -- we did have 
that week, though, | don't know if it was the next day, but -- oh, shoot, I'd have to go 
back. But he mentioned just how secure the election was at the DHS event, like the 
State of the Homeland event or whatever that was held at St. Elizabeth's. It was about 
that time. 

Q_ Take a look at exhibit 4 in your binder. 

A Uh-huh. 

Q__ It looks like this version of this document came out of a court file. That's 


that writing onthe top. But have you seen this statement before? 
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A | have. 

Q What is it? 

A This is a statement that was issued on the 12th of November by the 
Joint -- or by the Joint Executive Committees of the Sector Coordinating Council and the 
Government Coordinating Council. So every critical infrastructure sector has a GCC and 
an SCC. SCCis Sector Coordinating Council. GCC is the Government Coordinating 
Council. 

And those groups are comprised for the government, any State or Federal 
Government partners that may be involved in the critical infrastructure protection 
mission in that sector. The Sector Coordinating Council is the private sector side or the 
nonprofit side. The Executive Committees' membership are voted in or selected by the 
participating organizations in the councils. 

And they came together in the wake of the 2020 election and they developed the 
statement that says, as you see in this last line, "There is" -- or not this last line, but the 
bolded line: "There is no evidence that any voting system deleted or lost votes, changed 
votes, or was in any way compromised." 

That was the assessment of the practitioners. The frontline practitioners 
included election directors at the State level, secretaries of state, voting system 
executives, government -- Federal Government employees. 

| did not draft this. It came to me after it was drafted. |lookedatit. | said, 
this is a consensus statement built by the practitioners. | don't have anything to counter 
or disagree with this, so -- and they asked me for approval to release it. And | said, yeah, 
sure, | approve. 

Q  Doyou know who did draft it? 


A It was built by committee. The CISA representative to the Executive 
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Committee was Bob Kolasky, the career employee that's the Assistant Director of the 
National Risk Management Center. 

Do | know who put each word in there? No. 

Q  Andwas Mr. Kolasky, not just for the purposes of this statement, but 
generally the CISA representative on the Coordinating Council? 

A He was the senior representative, but the Coordinating Councils are 
supported and facilitated by CISA employees as a part of the Critical Infrastructure 
Protection Advisory Council structure, which is a statute that allows for, you know, 
collaboration in an antitrust-free space. And CISA has the statutory authority to 
facilitate and monitor. Bult, like | said, Kolasky was the senior here. 

Q So you were not part of the council? 

A | was not part of the council, no. I'm not part of any councils. | chair the 
Federal Senior Leadership Council, which is a -- all the Federal Government partners that 
sit on top of these structures. 

Q  Doyou know why the statement of this -- of the Coordinating Council was 
issued on CISA letterhead? 

A Because it was a statement from the Coordinating Committees, and CISA is 
the convening authority for the committees and -- or the councils and the committee. 
So it would not have been out of the ordinary to host a statement as a member of the 
committee. And| suspect that National Association of Secretaries of State, as a member 
of the committee, NASED, as a member of the committee, would have similarly hosted 
and promoted. 

Q | know you said you didn't draft this document. Are you aware of the 
impetus for this document? Do you know what caused the Council to convene to issue 


such a document? 
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A The specific impetus | know. | think | may have asked Masterson, Matt 
Masterson and Kolasky, you know, are the committees going to put anything out? 
Might they put anything out? And then there was a resulting document. 

Q Were you personally of the view that a statement regarding the security of 
the election should be put out? 

A | was of the view that a statement from the practitioners that had the 
visibility into how the election was conducted, that gave their perspectives, you know, 
whether it was CISA, from viewing the intelligence and operational activity from the 
election equipment, yes, that that would be helpful. 

Q Why did you think it would be helpful? What was going on at the time that 
caused you to think that a statement like that would be helpful? 

A __ There are significant -- there were a bunch of claims that votes -- that 
machines had been compromised and votes were being flipped and things of that nature. 

Q And know the various constituents here have their own perspective and 
what's important to them as to why they might have participated. But from CISA's 
standpoint, did you consider it part of CISA's mission to try to address the concerns that 
were -- address at some level the concerns that were being raised that you just 
described? 

A Again, | think where there's disinformation associated with the secure 
conduct of an election, where there are claims that, without any sort of support or 
evidence, that were catching -- not just catching but that were fairly pervasive, again, | 
thought it would be part -- it's part of the critical infrastructure protection mission to 
provide factual authoritative information about how things actually worked. 

Q_ Atthe time that you reviewed this statement, did you believe that that 


bolded sentence -- and | didn't do that bolding. |'m not sure -- let me ask you this: Do 
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you know if that was a bolded -- 
A | think we did that. Well, "we," | think the committee did that. 


Q  Sothe statement that was issued you believe had that sentence in bold? 


A Yes. 
Q Okay. 
A That's my recollection. 


Q When you read that statement, did you believe that that was true, from your 
perspective? 
A Yes, yes. 
Q Did you believe it was controversial? 
A |- 
Q_ That's maybe a bad question. I'm going to withdraw that because -- yeah, 
I'm going to withdraw that. 
Mr. Walden. Thank you. 
BY MR. KREBS: 
Q __ It's certainly contrary to what you had been seeing or hearing in media or on 
the internet? 
A It was certainly contrary to things like HAMMER SCORECARD. 
HL ct's go off the record for one second. 
[Discussion held off the record.] 
BY 
Q_ I'msorry, do you remember the question, because | don't? 
Mr. Walden. Yes. You had just withdrawn a question about whether or not he 


thought the bolded statement was controversial. 


MSs Yes, and then | -- | did do that. 


82 


BY 


Q And then| said that certainly there were statements being -- that were out 
in the media or on the internet that were contrary to this. And | think you were just 
starting to say something. 

A Yes, specifically HAMMER SCORECARD was one of the claims out there, that 
there was a supercomputer and software program that was changing votes. 

Q_ Asyou sit here today, do you have any -- you know, with a year -- more than 
a year sort of hindsight, do you have any doubts about the accuracy of that bolded 
statement? 

A Absolutely not. In fact, I'm more convinced that it's true, if that's possible. 

Q Has anyone ever presented you with evidence that you think would 
undermine that conclusion? 

A No, none. 

Q Were you ever told by anyone within DHS leadership that that bolded 
statement was inaccurate? 

A The only thing that | recall is a statement that, well, what if evidence comes 
along later that may disprove that statement? So why would you issue that statement if 
something down the road could be contrary? 

Q Who made that statement to you? 

A _ That was Chad Wolf. 

Q When? 

A Right around the time of the 12th or the 13th, | think. 

Q What was your response? 

A If additional evidence or information becomes available, we'll investigate, 


and we can amend and -- as necessary. But based on available information now, what 
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we know, what we see, this is accurate. And it has held up. 

Q___ Did you discuss with Mr. Wolf your view that it was important in terms of 
CISA's mission, as you just described a few minutes ago, to try to address misinformation 
that was out in the public sphere? 

A Specifically, | don't recall. | think that was generally part of the game plan 
and approach to the 2020 election. It was not just the technical piece, but the 
perception hack, the disinformation in providing accurate information about what we 
know happened with the election to the American people. 

Q___| guess what I'm getting at, and | don't want to put words in your mouth, but 
when he raised concerns about other information maybe coming out that would render 
this inaccurate, did you push back along the lines of, yeah, but this is important, | mean, 
this is helpful to address what's going on out there and to try and deal with 
misinformation; you know, words to that effect? 

A No, | -- so, to just kind of be a little bit more, you know, perhaps charitable to 
Chad, | mean, he was asking, you know this to be true -- as | understood it, you know this 
to be true. What if something -- you know, what if it ends up not being true? 

He wasn't challenging us necessarily. He was just trying to work through the 
decision process. And my point was, you know, here's our game plan. _ If there's 
additional information, we will investigate and we will work with, you know, our partners, 
certainly in the FBI, and issue -- you know, continue to keep the American people 
updated. But inthe meantime, it is important to put out the perspective of people that 
actually conduct elections on what happened, in the face of these -- the growing claims 
that, absent evidence, something did happen. 

Q What was Mr. Wolf's response to that? 


A Okay. 
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Q Did you sense that he was on board and understood and accepted your 
explanation or justification for the statement? 

A He didn't give any indication otherwise at the time, that | recall at least. 
But, again, | was exceedingly confident in the authority of the agency and my authority as 
the director that | wasn't looking for authorization or approvals. We were executing the 
game plan. 

Q Did Mr. Cuccinelli raise concerns with you about this statement after it was 
issued? 

A | don't recall. | don't know if | saw Ken after election day again. 

Q_ That was going to be my next question. Do you recall any conversation 
with Mr. Cuccinelli after election day but before you left the agency? 

A Not that | recall. | mean, | think -- hold on. 

So, no. The answer is still no. 

Q_ | think you mentioned -- 

A Can we go -- can | talk to them real quick? This is off -- can we go off the 
record? 

—— We are off the record. 

[Discussion held off the record.] 

MSs We're back on the record. 

, a 


Q_ Again, | forgot what question was pending. 

A So it's a combination of kind of try stay in your lane stuff and, you know, 
what Ken -- again, | did not talk to Ken, as | recall at least. There may have been a phone 
conversation or seen him in passing, but | don't specifically recall a meaningful 


conversation about any of this stuff between election night and my termination. 
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You know, the one observation | have is that Ken was -- you know, election night 
he was guest appearing on conservative radio shows from the CISA building, you know, at 
least three or four different ones. And then about this time or -- again, I'm not 
attributing this to Ken exactly, but there were leaks coming out from the Department to 
media -- CNN, Newsmax, CBS -- about CISA. And| don't recall if it was directly me, but, 


you know, what CISA's mission was. And that continued after | was fired. 


Q Negative -- 
A Yes. 
Q -- stories? 


A To your point of stay in your lane, that's -- you know, fraud -- domestic fraud 
is not CISA's mission, which the clear response there is that nor did we ever claim it to be. 
Q_ And inthe statement that we're looking at, do you understand that to be 


making statements or reference to -- 


A Nope. 
Q_ --election fraud? 
A Nope. 


Q Okay. Itdoessay: "no evidence that any voting system deleted or lost 
votes, changed votes, or was in any way compromised." What do you understand 
"voting system" to referto there? | know you didn't draft this document, but what's 
your understanding? 

A The technology. But -- | did not, but the actual people that conduct 
elections. And so, in their parlance, voting systems are the technologies, equipment, 
machines, computers, devices that are associated with the workflow of conducting an 
election from, you know, the casting, the counting, and the certification of the process. 


And that's exactly what that means. 
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Q I'm going to jump -- I'm trying to stay roughly chronological, but jumping a 
little bit out of order in terms of subject matter, because we're going to come back and 
talk about the fallout from the statement ina moment. But take a look at exhibit 6, 
because | think chronologically it's probably our next -- next in order. 

So this looks like, starting at the bottom -- and | think this is complete. | don't 
think | cut off any part of the relevant discussion. So the first email in the chain is 
November 13th at 10:14a.m. Do you see that? 

A Uh-huh. 

Q_ It's from AS1.. Who do you understand that to be? 

A Acting Secretary. StisSecretary. Ais Acting. Chad Wolf. 

Q Okay. So this is from Chad Wolf to you on Friday, November 13th? 

A Uh-huh. 


Do you recall this email? 


> Pp 


I do. 

Q_ Andis the document that's behind -- the immediate -- the document that | 
have immediately behind this -- 

A __ Right. 

Q_ -- which we're calling 6A, it's a two-sided page that's sort of fuzzy. The 
image is somewhat fuzzy, but a November 13th letter from two Michigan State Senators 
to Jocelyn Benson, the Secretary of State. Do you recall, was that the attachment to the 
November 13th email? 

A That is my recollection, yes. 

Q Do you know Jocelyn Benson? 

A | do. 


Q__Isshea person that you worked with in connection with your election 
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security efforts at CISA? 

A She was one of the senior election officials throughout the country, one of 
the many secretaries of state. And, yes, she was one of the secretaries of state that we 
worked with. _ | didn't work with her particularly closely before the election, but the 
team worked with her team. My team worked with her team. 

Q Okay. And!Ican see that you responded to Mr. Wolf within 3 minutes or so 
of getting his email. And yousaythat: "Weare aware of many of those claims and 
have discussed with Michigan over the last week, with Michigan addressing most of 
them." 

A Uh-huh. 

Q_ Tell me about your discussions with Michigan authorities leading up to the 
receipt of this -- or, you know, prior to the receipt of this email and letter. 

A So, basically, what would happen is, as any -- as | already mentioned, as any 
sort of issues would pop up or be, you know, noticed, detected in the news, 
we -- someone at the Matt Masterson level or down would reach out to the State, their 
designated point of contact or his relationship, and say, hey, seeing this is getting 
reported, what's going on, and do you have anything that you've issued, any statements, 
are you going to issue a statement? And so that would then feed back to us, and, you 
know, okay, great. 

And generally, where we're trying to end every one of those engagements was, is 
there something that we need to be worried about here? And inthe case of Antrim 
County and the -- specifically point one and the database issue, no, they caught it. It 
was a database configuration issue. They didn't update for that precinct. It was 
detected. They reconfigured and the votes are accurately counted. 


Q And you had had that Antrim County discussion before you ever got the 
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email from Mr. Wolf? 

A Yeah. | mean, that was November 7th. It actually happened earlier than 
that, but -- | don't recall specifically what the certification deadline is for Michigan, but 
they caught it fairly early on. 

And, again, it was -- it was just sloppiness at the programming level with the 
database. They saw, oh, basically the way that -- they were counted accurately, but 
when they were deposited into the database for tracking purposes, they had 
not -- basically, the columns were not appropriately set. Went back through, said, oh, 
didn't update this database. Updated it. Boom, the votes come, as unofficial but 
accurate. 

Q  And-- sorry. 

A _ And that sort of process happens through canvassing. You catch if there 
are mistakes, but there was no malicious intent here. 

Q_ And it looks as if, based on the next email in the chain, and you say it got 
stuck in your outbox, so maybe you can help me on sort of when you think you drafted it, 
you know, relative between Friday and Monday. 

A It was either -- either Friday afternoon or over the weekend. 

Q Sol guess what I'm getting at is, I'm not going to -- you know, the exact time 
or day even doesn't really matter, but I'm curious as to whether -- how promptly 
generally you were able to track down the information that you needed to address the 
concerns in that letter. 

A | got what | needed from Masterson probably within a matter of an hour. 
Again, we were aware of these things. Some of them fell outside of, you know, 
the -- the -- you know, I'll -- you know, when you talk about official intimidation and 


interference with lawful election challengers and poll watchers, | would -- | would say 
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that -- you know, if we're talking about lanes, | would say that that's not something that 
we would typically track, because it's -- it's not directly related to the infrastructure. But 
it was in the -- it was in the -- it was in the letter. So based on what we understood, 
based on what Michigan has posted, what they gave to us, we provided it back. 

And | think really what happened here more than anything probably is that the 
White House sent this to Chad, said, Chad, what's going on? | want all of these things 
addressed. We gave them the information back. 

Q_ And you think that the body of that Monday, November 16 email probably 
came to you from Matt Masterson, in terms of tracking down the PDFs? 

A Yeah, | mean, if | -- do | think that -- you know, | think what happened is | got 
the one, two, three, four links, that content from Matt or the team, the Election Security 
Initiative team, and then | dropped a preface on and the front matter and sent it up. 

Q Okay. And|can see -- as we were talking about the other issues, you were 
flipping through, and you can see what we're calling 6B is the posting regarding Antrim 
County. 

A _ Right. 

Q And 6Cisa more general posting regarding the absentee ballot process. 

A _ Right. 

Q_ That my understanding is, although it's not dated, that this -- 

A The TCF Center thing, yeah. 

Q__ This information was on the State of Michigan's website on November 16th. 
It existed at the time. 

A _ Right. 

Q_ The link | think in your letter is dead at this point, but -- 


A Okay. 
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Q_ --that's my understanding. 

A Okay. 

Q  Sodo you think you saw these two documents, 6B and 6C, before you 
responded to Mr. Wolf? 

A Yes. 

Q And from your perspective, did it resolve the -- other than the observing of 
intimidation of poll watchers and things that | think you said might be outside the lane of 
CISA or are outside the lane, did you feel that this material you got from the Secretary of 
State's office or their website addressed the other -- the sort of cybersecurity claims that 
were being made? 

A _ | was confident that the matter was closed. But whether that addressed 
the conspiracy theorists out there, that's a different matter. 

Q Did Mr. Wolf respond at all to your -- 

A Not that I recall. 

Q_ -- Monday email? 

A Not that | recall. Certainly not with any followup. 

Q My understanding is the next day you were terminated. 

A Sounds right. 

Q Okay. Takealook at back at exhibit 5. It's a letter dated November 17th 
from John McEntee to you. Have you seen this before? 

A You know, in the exhibits that were provide -- 

Mr. Walden. | just want to say, could you clarify, before today or at the time? 

Ys 
Q Before today, have you seen this document? 


A So | saw -- you know, | saw this yesterday or Tuesday. And I'll admit that 
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when | saw it then, it was like, | don't know if I've seen this before. So! know that in the 
exhibits provided that it was in an attachment to an email that was sent to me from 
someone, but you have to keep in mind, even whenever that was dated, that email 

was -- the date stamp on that, | probably got a thousand emails that night. 

And | actually put down my work device and wasn't using my -- | mean, | 
considered myself terminated. So | don't know if | actually even looked through all my 
email that evening. 

Q  Gotit. Soit's possible that this termination letter was transmitted to you 
on December -- on November 17th, 2020, but you don't recall or you did not see it then? 

A Not that | recall. 

Q Okay. How did you learn that you had been terminated? 

A Someone sent me a text that said, You just got fired on Twitter. And my 
immediate reaction was like, nah, nah, you're thinking about -- you read that article last 
week from Natasha Bertrand in Politico. And lo and behold, | pull up Twitter and there it 
is, 7:05, 7:06 p.m. 

Q What did you pull up on Twitter? 

A The President's tweet. It was two tweets, and it says basically because l, 
you know, made statements that were untrue that I'd been terminated as Director of 
CISA. 

Q_ Anddid you sort of take that as sort of actionable or did you seek out some 
confirmation from one of your superiors in the Agency or the Department? 

A | immediately called Chad Wolf. He was not available. So| puta call in, | 
guess -- as I've been refreshed from the exhibits, | guess | called the watch -- the DHS 
NOC, the Ops Center, and said, hey, trying to get ahold of the Secretary. Called him. 


He called me back. 
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Fairly soon after, also -- you know, you'd have to look at -- | don't recall the actual 
sequencing, but then | called my chief of staff. | called -- talked to Matt Travis, and | 
think | also probably talked to Brandon Wales. 

Q So you determined that the tweet was actionable, that you had, in fact, been 
terminated? There have been examples of Presidential tweets that I've read or heard 
about that were actually -- 

A There was zero ambiguity, zero ambiguity from the tweets. 

Q_ And you were a Presidential appointee, so presumably the President has the 
authority to fire you whenever he wants. 

A And from past practice, you know, under -- even -- yes. Sol had enough to 
understand that | was fired. 

Q Okay. 

Mr. Walden. Just so the record is clear, did you have a conversation with Chad 
Wolf where he confirmed it? 

Mr. Krebs. Yes. And he said, oh -- something to the effect of, oh, god, that 
wasn't supposed to happen like that. 

BY 

Q Okay. Did he give you any explanation as to why it happened? Not why 
the tweet happened, but why you were being terminated. 

A | don't recall specifically what any sort of -- but | think it was fairly obvious, 
and obvious being that, you know, we were providing factual information about the 
security of the election. 

Q__Inyour mind -- because you're saying it was obvious to you, in your mind, 
was it tied to this November 12th statement that we were looking at or something else or 


an aggregation or accumulation of such statements? 
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A | would not attribute it to any single event. 

Q Okay. Did anyone ever tell you, you know, that November 12th statement, 
that -- you shouldn't have sent that out, that's the reason you got fired? 

A Not that | recall. 

Q_ And it's not your understanding that it was that -- standing alone, it was not 
that statement? 

A | don't have any information. | was never provided any information that 
that was a -- 

Q- Okay. | said! was going to try and proceed chronologically, but | realize | 
have an exhibit in here that is a bit out of order, and it's just sort of a random question for 
you. It's exhibit 7. 

A Uh-huh. 

Q_ This appears to be an email from AS. And my understanding is that the 
redaction inadvertently deleted the number 2. So it should be from AS2. 

A Uh-huh. 

Q Do you know who AS32 is? 

A AS2 would be Ken Cuccinelli. 

Q And youcan see it's signed "See you shortly. Ken." 

A _ Right. 

Q  Dovyou have any recollection of getting this email from Mr. Cuccinelli on 
November 3rd? 

A | do not. 

Q  Doyou have any understanding of what this email refers to? 

A One query | picked up from the congressional call was regarding the 


CISA.gov/rumorcontrol page. 
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So throughout the -- the congressional call, | will stipulate that | don't know 
specifically there, but throughout the day, in addition to the press calls, we were doing 
updates to congressional members and staff. 

And we had actually been -- | had been providing briefings to Congress for months 
about our preparation. And those sort of died off as an interagency prior to, you know, 
I'd say right around August, but we continued as an agency to give those on a biweekly 
basis probably. And, you know, we'd open it up to -- we do a House call and then we do 
a Senate call. And, you know, again, still in the middle of COVID. We'd be kind of 
doing these all over the place. 

So on the day of the election, it may have even been -- | think there was at least 
one the day of the election, and we were just kind of talking about, here's what we're 
seeing out there. And we knew the issues that were popping up on that day, and they 
were, you know, like poll book issues or power outages or things like that. And we'd 
say, hey, look, these are the key things we're seeing. But other than the 
adversary -- you know, other than that, we're not seeing any adversary activity. It 
seems to be actually a pretty quiet and calm election. 

And | don't recall specifically what the question is or who asked it, but | assume 
something came up like, hey, I'm hearing about this rumor control thing, tell me about 
that. And -- 

Q Okay. 

A That's my understanding -- my recollection, rather. 

Q You don't have a recollection of a specific aspect of a rumor control page 
that was being inquired of, just -- 

A Not that | recall. 


Q Okay. 


No. 
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[1:16 p.m.] 
CY 

Q Okay. 

Okay. | want to go through a couple of points here with you just to get a sense 
of your familiarity and understanding and what your, sort of, state of knowledge is on 
this. 

There have been questions raised about Dominion voting machines. You 
referenced dead foreign dictators -- 

A _ Right. 

Q  --andsoforth. Are you generally familiar with the testing or evaluation 
that is done on Dominion voting machines by the various States that have used them? 

A Yeah, so my -- it's been a year or so since I've actually jumped into the details 
of what States do and what the standards are. But, yes, generally speaking, there is a 
set of voluntary standards that the Election Assistance Commission publishes, there are 
labs that the EAC accredits, and then there are, in some States, State-specific 
accreditation labs. 

And so, you know, virtually every State has some kind of testing standard. 
They're not allthe same. Some are more rigorous than the Federal guidelines, and 
some States, you know, just kind of follow whatever the Federal Government 
recommends, the EAC recommends. But it's all -- it's kind of a mixed bag across the 
landscape. 

Q Andare you apprised of and typically -- a bad question. Is CISA apprised of 
whether a particular voting machine has met or not met various State standards, or it's 


just sort of up to the States to do what they do? 
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A The States generally do what they do. 

Q Have you ever been apprised of particular issues that have come up with 
respect to State testing or State evaluation of Dominion Voting Systems? 

A Specifically Dominion, | can't recall any specific issue necessarily. 

| know there was something in Texas about, Texas had a rigorous -- it's not 
rigorous, but Texas had a set of State requirements that some machines -- | don't recall if 
it was Dominion or ES&S, but that a system may not have passed the State certification 
process. But it wasn't necessarily because of any sort of security standard. But| 
believe, in this case, they did issue -- Texas issued some sort of assessment and 
decertification of asystem. Again, | don't recall if it was Dominion or ES&S. 

Q Okay. And are you able to say with any degree of certainty that, 
if -- because it may vary State by State, but that, if a Dominion voting hardware -- because 
| know there's -- is there software and hardware that's created by Dominion? 

A Yes. There's machines, and then there's the software that actually sits on 
top of, in many cases, like, a Windows operating system that's specific to -- 

Q Are you able to say with any level of confidence that -- the fact 
that Dominion Voting Systems could not have been used in the United States had they 
not gone through some -- the respective testing protocols of the States in which they're 
used? 

A | -- so | -- 

Q_ Terrible question. 

A Yeah. So States have certification processes. And, to use the equipment 
in a State, you have to follow their regime, as | understand it. 

Q Okay. 


A Generally speaking. Could there be individual State-by-State exceptions? 
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You know, | don't -- 

Q Yeah. Yeah. Okay. 

Have you ever had any interactions with a person named Russell Ramsland? 

A | never have, no. 

Q Do you know whether Mr. Ramsland ever presented to folks within CISA 
concerns that he had about electronic voting? 

A So whether Mr. Ramsland specifically -- and Mr. Ramsland is with ASOG, 
Allied Security Operations Group. | don't know specifically if Mr. Ramsland briefed any 
CISA employees, but | believe representatives from ASOG briefed CISA and other DHS 
employees in the State of Texas. 

And then, subsequently, as | understand it, he briefed, as encouraged by the 
Senate Homeland Security Committee, majority staff at the time, under Chairman Ron 
Johnson -- the Senate staff directed CISA -- requested CISA headquarters personnel, | 
guess, meet with ASOG personnel to review whatever findings they had. 

Q Were you part of those meetings? 

A Absolutely not. | never heard about it until well after | was relieved of 


duty. 


Pp 


Would that have been Matt Masterson most likely? 


> 


| don't believe so. 

Q  Whodo you -- 

A | believe they may have brought in probably some -- there was probably 
some lower-level career staff and then also some outside consultants that are experts in 
election technology. 

Q 9 Okay. 


So, before we wrap up, | want to ask you about some, sort of, reflections on the 
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2020 election and maybe your thoughts on certain recommendations. _ | know, in your 
Senate testimony that we looked at earlier, exhibit 1, you had some bullet-point 
recommendations that you thought should be considered by the Senate. 

A Uh-huh. 

Q_ And | want to give you a chance to talk about some of that. 

Okay. 

Q_ There are -- several recent polls have shown that a large percentage of 
Americans believe that the 2020 Presidential election was stolen. Are you generally 
familiar with that sentiment? 

A Yes, |am. 

Q Doyou have a view as to what accounts for that? 

A My personal, Chris Krebs, belief that the reason particularly that that 
number is much higher skewed in Republican circles is because Republican officials, 
senior officials, including the former President, lied to the American people about the 
security of the 2020 election, that it was stolen. So it's a self-reinforcing cycle. 

Q Does it concern you, as someone who spent a good part of your professional 
career dealing with risk generally and election security risk, does it concern you that 
there's a substantial portion of the American population that thinks that the Presidential 


election in 2020 was stolen? 


A Yes. 
Q Why? 
A If you don't have confidence in the processes by which we choose our 


elected officials, those that represent us, then you start to doubt other mechanisms of 
democracy. 


And democracy is a -- unfortunately, a contact sport, but also requires active 
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engagement and participation. And so what | fear is that we will see disengagement 
from democracy that will lead us into, you know, antidemocratic forms of government. 

Q__Inyour view, what could have been done or can be done to combat the type 
of disinformation that you're talking about? 

A So -- 

Q  Orkeep it from taking hold as it has? 

A So I'd separate the actual disinfo, in and of itself, but we need to improve 
upon the structures by which we conduct elections. And I'm specifically talking about 
the electoral count, or the Electoral Count Act. 

And Ben Ginsberg had a pretty good op-ed, | think, in the National Review Online 
last week where he ticks through about a dozen or so things that need to be clarified 
from that law from the 1860s or whatever it was, you know, including clarifying the role 
of the Vice President and whether the Vice President is, in fact, just a ceremonial role or 
not. 

And, in part, the point that he makes is that, you know, Republicans, in this case, 
should be careful what they wish for, because in 2024 Kamala Harris is going to be the VP. 
And so, if they -- you know, they've given a game plan. And, while Pence didn't follow it 
in 2020, if Kamala Harris followed it in 2024, that obviously wouldn't work to the 
Republicans. So it's in everybody's interest to actually clarify how the electoral college 
mechanism works. 

So, again, start with clarifying the Vice President's role; clarifying how 
disagreements are adjudicated between the House and the Senate if they have a 
disagreement; clarify at the State level who the executive is that's responsible for 
certifying the slate -- because you could see a Republican and Democrat from 


different -- you know, one serving Governor, the other serving as a secretary of state, and 
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they could each claim to be the executive, and you could have those dueling slates. So 
clarify who the State executive is; you know, perhaps look at things like increasing the 
number of Congresspeople that can object to a slate from a State, instead of just one, 
actually raise the threshold there. 

So, again, Ginsberg's got a pretty solid list. | encourage every -- you know, that 
that's in everyone's interest. That's point one. 

So | think there are a few other things. _ | think, you know, when you look at all of 
our ilk, as lawyers, there were a number of attorneys that were involved in filing, as we've 
seen in Michigan and elsewhere, at least sanctionable lawsuits, but 60-plus that were 
thrown out. | think we need, you know, to reinforce some of the societal norms in 
particularly those bodies like bar associations and even, if you look at COVID, with 
medical licensing boards. There are actually some self-policing and self-reinforcing 
mechanisms that we're not going to tolerate this and we can police ourselves. So that's 
number two. 

Number three, | think -- and these are some recommendations from the Aspen 
Commission -- you know, some regulation around social media platforms, not ina 
managing or moderating content perspective, but just from a transparency in how these 
platforms, you know, enforce their own terms of service and inconsistency. Because 
there's not necessarily a whole bunch of consistency in how they do things from country 
to country. 

And then, you know, lastly, when you just think about -- and this is the hardest 
part. The hardest part, as | see it is -- this goes back to that point about democracy. 
You know, democracy and elections require both parties commit to the democratic 
process and that they commit to honoring the outcome of a legitimate election. If one 


decides not to participate in that, then that's not much of ademocracy. So actually 
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reinforcing committing to elections. 

Now, how do you enforce that? Obviously we see, right now, we're not getting a 
whole lot of enforcement. There's no mechanism to hold those that are making these 
claims, other than at the ballot box. But even that's not good enough, because those 
structures here are not exactly holding some of these elected officials accountable for 
continuing to propagate claims. 

So this is hard. You know, a lot of, kind of, the Soeech and Debate Clause gives a 
lot of coverage for, you know, Members of the Congress to make these claims. So| 
think we have to continue investigating and, you know, developing options to help to 
hold these folks, particularly elected officials, accountable. 

And the last thing I'll say is that, you know, this is a -- not only, you know, it's a 
contact sport, but it's also requiring whole of society to recommit. So, you know, 
something to the order of, you know, business leaders tend to be more higher respected, 
regarded, whatever, and so businesses need to take a hard look at, you know, froma 
political -- you know, post-Citizens United, you know, if they're contributing to political 
campaigns, that, you know, they should not be contributing to campaigns of candidates 
for office that continue to promote baseless conspiracy theories about the theft of 
election. | think they're contributing to the downfall of America. 

Q Do you think the government or we, as a society, or maybe the government, 
in terms of CISA, has done enough to counter the false information that's come out with 
respect to the 2020 election? 

A | think that, under the constructs of the First Amendment, there is only so 
much the government can do besides provide accurate information on how elections are 
conducted and, you know, what has happened in the past and what will happen going 


forward. 
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But you don't overcome disinformation with more information, with truth. You 
have to get it at a much, much, much more foundational level and undercut some of the 
structural incentives for those that continue to promote it and those that want to. 

Q But -- and | appreciate your thoughtful comments on this, and | don't want 
to sort of belabor it, but, you know, we started the discussion today, or this interview, 
talking about, sort of, some of the threats from Russia to sow distrust and so forth. Did 
you ever in your wildest, sort of, imagination think in 2017, when you were thinking 
about how to deal with disinformation and how it might -- | think you called it a cancer 
that could sort of grow and erode American values -- that we'd get to a point where 
two-thirds of one of the major political parties in the country don't believe in elections 
anymore or don't believe they can be trusted? 

| mean, it seems as that -- | mean, if the Russians were doing this and got to that 
level of penetration, would that be alarming -- 

A Of course it's alarming. But even if it is Russian disinformation that an 
American citizen picks up and then promotes on Twitter, it's still an American citizen 


expressing their First Amendment views. And that's -- 


Q | guess what I'm asking -- 
A -- permissible. 
Q- --is: Have your worst fears, when you set out on this mission of trying to 


sort of protect the integrity of elections, in some sense been -- 
A It's worse than | thought. 
Q Okay. Because the level of penetration, or just the -- 
A Active participation by the political class in American democracy. 
Q  Anddo you think that creates greater challenges than even dealing with, sort 


of, a malign foreign actor? 
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A Much, much, much, much, much harder because of the First Amendment 
issues, because there's no accountability measures, there's nothing we can, again, do 
right now to -- you know, there are things that, if it was a Russian doing what the former 
President continues to do to this day, then there are mechanisms in place to intercept 
and intervene in that information. But the fact that it's an American citizen promoting 
their own view, which is their right under the First Amendment, even if it's cancerous and 
contrary to democracy, there's not a whole lot to do, other than -- sorry. 

Mr. Walden. No, no, you're okay. You misread me. 

Mr. Krebs. But this is -- you know, as soon as you get, you know, an interested 
party as the target of the defamation, like Dominion Voting Systems, they have legal 
recourse. They can sue for $1.3 billion, as they are. But the problem here is that it's 
going to take multiple years to settle that, or not settle, but actually come to, you know, 
some finality if it makes it that far. And, by then, the damage is done. 


Well, on that somewhat depressing note, | think we'll -- 


Mr. Krebs. Welcome to my life. 


I'm sorry? 
Mr. Krebs. Welcome to my life. Yeah. 


-- we'll call it a day. 


So let's go off the record. 


[Whereupon, at 1:34 p.m., the interview was concluded.] 


Certificate of Deponent/Interviewee 


| have read the foregoing pages, which contain the correct transcript of the 


answers made by me to the questions therein recorded. 


Witness Name 


Date 


105 


